Files

setup.src cli.src libs/list.src libs/thor.src libs/nmap.src libs/scan.src
setup.src
  • import_code("/home/me/h/libs/list.src")
  • import_code("/home/me/h/libs/disk.src")
  • import_code("/home/me/h/libs/passwords.src")
  • Disk.init("/home/me/h/disks", "passwords")
  • if(Disk.blobs.len > 1) then exit("password generation setup already completed")
  • PasswordGenerator.init(PASSWORDS)
  • print("generating passwords, it will take a while")
  • HASH_TABLE=PasswordGenerator.AllPasswords
  • print("done")
  • print("parsing passwords obj")
  • f = function(o)
  • return o[1]
  • end function
  • pass_list = Lst.map(Lst.to_list(HASH_TABLE), @f)
  • pass_list = HASH_TABLE.to_list.map(@f)
  • print("done")
  • print("writing to disk")
  • Disk.write(pass_list.join(char(10)))
  • print("done")
cli.src
  • import_code("/home/me/h/libs/list.src") // exports Lst
  • import_code("/home/me/h/libs/disk.src") // exports Disk, Block
  • import_code("/home/me/h/libs/nmap.src") // exports Nmap, Service
  • import_code("/home/me/h/libs/scan.src") // exports Scan
  • import_code("/home/me/h/libs/machine.src") // exports Machine, MachineService, depends on Lst, Scan, Nmap
  • import_code("/home/me/h/libs/machine.src") // exports Machine, MachineService, depends on Scan, Nmap
  • Machine.metaxploit = include_lib("/lib/metaxploit.so")
  • Scan.metaxploit = include_lib("/lib/metaxploit.so")
  • Disk.init("/home/me/h/disks", "passwords")
  • Vega = {}
  • Vega.vega_sig = {}
  • Vega.vega_sig["description"] = "auto hacking tool"
  • Vega.vega_sig["args"] = ["ip*"]
  • Vega.vega_sig["options"] = [{["-v", "--verbose"]: "print more logs"}]
  • Vega.vega = function(args = [], options = {})
  • //TODO: check if ip is valid
  • ip = args[0]
  • has_verbose = options["-v"]
  • machine = new Machine
  • machine.init(ip)
  • machine.most_vulnerable_service.set_exploits
  • print(machine.most_vulnerable_service.exploits)
  • end function
  • import_code("/home/me/h/libs/thor.src") //depends on Lst, exports Thor
  • Thor.init(Vega, "vega")
libs/list.src
  • Lst = {}
  • Lst.to_list = function(map, shallow = false)
  • map.to_list = function(shallow = false)
  • list = []
  • for i in map.indexes
  • if typeof(map[i]) == "map" then
  • for i in self.indexes
  • if typeof(self[i]) == "map" then
  • if shallow == true then
  • list.push([i, map[i]])
  • list.push([i, self[i]])
  • else
  • list.push([i, Lst.to_list(map[i])])
  • list.push([i, self[i].to_list])
  • end if
  • else
  • list.push([i, map[i]])
  • list.push([i, self[i]])
  • end if
  • end for
  • return list
  • end function
  • Lst.to_map = function(list)
  • l = list[0:]
  • list.to_map = function()
  • l = self[0:]
  • map = {}
  • for i in indexes(l)
  • if typeof(l[i][1]) == "list" and l[i][1].len == 2 and typeof(l[i][1][0]) == "string" then
  • map[l[i][0]] = Lst.to_map(l[i][1])
  • map[l[i][0]] = l[i][1].to_map
  • else
  • map[l[i][0]] = l[i][1]
  • end if
  • end for
  • return map
  • end function
  • Lst.each = function(obj, func)
  • if typeof(obj) == "map" then
  • list = Lst.to_list(obj, true)
  • else
  • list = obj
  • end if
  • list.each = function(func)
  • result = self[0:] //list copy.
  • for i in indexes(self)
  • func(result[i])
  • end for
  • end function
  • map.each = function(func)
  • list = self.to_list(true)
  • result = list[0:] //list copy.
  • for i in indexes(list)
  • if typeof(obj) == "map" then
  • func(result[i][0], result[i][1])
  • else
  • func(result[i])
  • end if
  • func(result[i][0], result[i][1])
  • end for
  • end function
  • Lst.map = function(list, func)
  • result = list[0:] //list copy.
  • for i in indexes(list)
  • list.map = function(func)
  • result = self[0:] //list copy.
  • for i in indexes(self)
  • result[i] = func(result[i])
  • end for
  • return result
  • end function
  • Lst.reject = function(list, func)
  • result = list[0:] //list copy.
  • list.reject = function(func)
  • result = self[0:] //list copy.
  • i = 0
  • while i < result.len
  • if func(result[i]) == true then
  • result.remove(i)
  • continue
  • end if
  • i = i + 1
  • end while
  • return result
  • end function
  • Lst.select = function(list, func)
  • result = list[0:] //list copy.
  • i = 0
  • while i < result.len
  • if func(result[i]) == false then
  • result.remove(i)
  • continue
  • end if
  • i = i + 1
  • end while
  • return result
  • end function
  • Lst.find = function(list, func)
  • for i in list
  • if (func(i)) then
  • return i
  • end if
  • end for
  • return null
  • list.select = function(func)
  • f = function(o)
  • return not func(o)
  • end function
  • return self.reject(@f)
  • end function
  • // do not rename funcc to to func it will infinite loop
  • Lst.lsort = function(list, funcc)
  • list.lsort = function(funcc)
  • f = function(i)
  • return Lst.to_map([["sort_key", funcc(i)], ["obj", i]])
  • return {"sort_key": funcc(i), "obj": i}
  • end function
  • result = Lst.map(list, @f)
  • result = self.map(@f)
  • result = result.sort("sort_key")
  • f = function(i)
  • return i["obj"]
  • end function
  • return Lst.map(result, @f)
  • return result.map(@f)
  • end function
  • Lst.flat = function(list)
  • list.flat = function()
  • result = []
  • for i in list
  • for i in self
  • if typeof(i) == "list" then
  • result = result + Lst.flat(i)
  • result = result + i.flat
  • else
  • result.push(i)
  • end if
  • end for
  • return result
  • end function
  • Lst.uniq = function(list)
  • list.uniq = function()
  • result = []
  • for i in list
  • for i in self
  • if result.indexOf(i) == null then result.push(i)
  • end for
  • return result
  • end function
  • Lst.has_any = function(list, value)
  • for i in list
  • list.has_any = function(value)
  • for i in self
  • if i == value then return true
  • end for
  • return false
  • end function
  • Lst.min = function(list)
  • min = list[0]
  • for item in list
  • list.min = function()
  • min = self[0]
  • for item in self
  • if item < min then
  • min = item
  • end if
  • end for
  • return min
  • end function
  • Lst.max = function(list)
  • max = list[0]
  • for item in list
  • if item < max then
  • list.max = function()
  • max = self[0]
  • for item in self
  • if item > max then
  • max = item
  • end if
  • end for
  • return max
  • end function
libs/thor.src
  • ThorCommand = {}
  • ThorCommand = {}
  • ThorCommand.init = function(func, sig, name)
  • self.name = name
  • self.func = @func
  • if sig.hasIndex("description") then self.description = sig["description"]
  • if sig.hasIndex("args") then
  • self.args = sig["args"]
  • end if
  • if sig.hasIndex("options") then
  • f = function(obj)
  • param = {}
  • param["name"] = obj.indexes[0]
  • param["description"] = obj[obj.indexes[0]]
  • return param
  • end function
  • self.options = Lst.map(sig["options"], @f)
  • self.options = sig["options"].map(@f)
  • end if
  • end function
  • ThorCommand.required_args = function()
  • f = function(obj)
  • return obj[-1:] == "*"
  • end function
  • return Lst.select(self.args, @f)
  • return self.args.select(@f)
  • end function
  • ThorCommand.optional_args = function()
  • f = function(obj)
  • return self.required_args.indexOf(obj) == null
  • end function
  • return Lst.select(self.args, @f)
  • return self.args.select(@f)
  • end function
  • ThorCommand.options_list = function()
  • f = function(o)
  • return o.name
  • end function
  • return Lst.map(self.options, @f)
  • return self.options.map(@f)
  • end function
  • ThorCommand.args_help = function()
  • out = self.name
  • for arg in self.args
  • out = out + " " + arg
  • end for
  • return out
  • end function
  • ThorCommand.options_help = function()
  • out = "options for " + self.name + ":" + char(10)
  • for i in self.options
  • n = i.name
  • if typeof(i.name) == "list" then n = i.name.join(" or ")
  • out = out + n + " : " + i.description
  • if self.options.indexOf(i) < self.options.len - 1 then out = out + char(10)
  • end for
  • return out
  • end function
  • ThorCommand.help = function()
  • out = self.args_help + char(10) + char(10)
  • out = out + self.options_help + char(10) + char(10)
  • out = out + self.description
  • return out
  • end function
  • ThorCommand.exec = function()
  • self.func(self.passed_args, self.passed_options)
  • end function
  • // class divider ---------------------------------------
  • ThorManager = {}
  • ThorManager.init = function(thor)
  • self.thor = thor
  • end function
  • ThorManager.eval_command = function(command)
  • used_args = self.thor.global_args[:command.args.len]
  • self.thor.global_args = self.thor.global_args[command.args.len:]
  • self.thor.used_options = self.thor.used_options + Lst.flat(command.options_list)
  • self.thor.used_options = self.thor.used_options + command.options_list.flat
  • for i in range(command.args.len - used_args.len - 1)
  • used_args.push(null)
  • end for
  • command["passed_args"] = used_args
  • command["passed_options"] = self.options_by_key(command)
  • self.thor.global_execution_queue.push(command)
  • end function
  • ThorManager.options_by_key = function(command)
  • scope = self
  • r = {}
  • get_value = function(o)
  • if o.indexOf("=") then
  • striped_options = self.thor.striped_global_options
  • striped_options = scope.thor.striped_global_options
  • if striped_options.indexOf(o) then
  • value = self.thor.global_options[striped_options.indexOf(o)]
  • value = scope.thor.global_options[striped_options.indexOf(o)]
  • return value[value.indexOf("=")+1:]
  • else
  • return null
  • end if
  • else
  • if self.thor.global_options.indexOf(i) != null then return true
  • if scope.thor.global_options.indexOf(i) != null then return true
  • return null
  • end if
  • end function
  • for o in command.options_list
  • if typeof(o) == "list" then
  • v = null
  • for i in o
  • if get_value(i) != null then v = get_value(i)
  • end for
  • for i in o
  • r[i] = v
  • end for
  • else
  • r[o] = get_value(o)
  • end if
  • end for
  • return r
  • end function
  • // class divider ---------------------------------------
  • Thor = {}
  • Thor.init = function(class, main_func_name)
  • self.class = null
  • self.global_args = []
  • self.passed_args_count = 0
  • self.global_options = []
  • self.used_options = []
  • self.global_execution_queue = []
  • self.manager = new ThorManager
  • self.manager.init(self)
  • main_command = new ThorCommand
  • main_command.init(class[main_func_name], class[main_func_name+"_sig"], main_func_name)
  • self.params_to_args_options(params)
  • self.manager.eval_command(main_command)
  • self.catch_errors
  • self.exec_queue
  • end function
  • Thor.striped_global_options = function()
  • f = function(ob)
  • if ob.indexOf("=") then
  • return ob[:ob.indexOf("=")+1]
  • end if
  • end function
  • return Lst.map(self.global_options, @f)
  • return self.global_options.map(@f)
  • end function
  • Thor.params_to_args_options = function(params)
  • // filter for args
  • f = function(p)
  • return p[0] == "-"
  • end function
  • args = Lst.reject(params, @f)
  • args = params.reject(@f)
  • options = {}
  • f = function(param)
  • return param[:1] == "-" and param.indexOf("=") == null
  • end function
  • params_options = Lst.select(params, @f)
  • params_options = params.select(@f)
  • f = function(param)
  • if param[:2] != "--" and param.len > 2 then
  • r = []
  • for i in param[1:].values
  • r.push("-" + i)
  • end for
  • return r
  • else
  • return param
  • end if
  • end function
  • params_options = Lst.uniq(Lst.flat(Lst.map(params_options, @f)))
  • params_options = params_options.map(@f).flat.uniq
  • f = function(param)
  • return param[:1] == "-" and param.indexOf("=") != null
  • end function
  • params_value_options = Lst.select(params, @f)
  • params_value_options = params.select(@f)
  • options = params_options + params_value_options
  • self.global_args = args
  • self.passed_args_count = args.len
  • self.global_options = options
  • end function
  • Thor.catch_errors = function()
  • if self.global_options.indexOf("-h") != null or self.global_options.indexOf("--help") != null then
  • print(self.global_execution_queue[-1].help)
  • exit()
  • end if
  • f = function(c)
  • return c.required_args.len
  • end function
  • required_args = Lst.map(self.global_execution_queue, @f)
  • required_args = self.global_execution_queue.map(@f)
  • if self.passed_args_count < required_args.sum then
  • print("error: required params not passed, check the docs")
  • exit()
  • end if
  • used_options = self.used_options + ["-h", "--help"] //cant use self inside the block
  • f = function(p)
  • return used_options.indexOf(p) == null
  • end function
  • undefined_options = Lst.select(self.striped_global_options, @f)
  • undefined_options = self.striped_global_options.select(@f)
  • for i in undefined_options
  • print("error: " + i + " option is not defined, check the docs")
  • exit()
  • end for
  • end function
  • Thor.exec_queue = function()
  • self.global_execution_queue[-1].exec
  • end function
libs/nmap.src
  • map = function(list, func)
  • result = list[0:] //list copy.
  • for i in indexes(list)
  • result[i] = func(result[i])
  • end for
  • return result
  • end function
  • Service = {}
  • // port : port number
  • // state : closed or open
  • // lan_ip
  • // info : service name and version
  • // port_obj : port obj
  • // version_to_int : int of 3 digits
  • Service.init = function(nmap, port)
  • self.nmap = nmap
  • self.port_obj = port
  • self.port = self.port_obj.port_number
  • self.status = "open"
  • if(self.port_obj.is_closed and not self.nmap.is_lan) then
  • self.status = "closed"
  • end if
  • self.info = self.nmap.router.port_info(self.port_obj)
  • self.lan_ip = self.port_obj.get_lan_ip
  • self.version_to_int = self.info.split(" ")[1].split(".").join("").to_int
  • end function
  • Service.inspect = function()
  • return {"port": self.port, "status": self.status, "lan_ip": self.lan_ip, "info": info}
  • end function
  • Nmap = {}
  • Nmap.init = function(ip)
  • self.ip = ip
  • if not is_valid_ip(self.ip) then exit("nmap: invalid ip address")
  • self.is_lan = is_lan_ip(self.ip)
  • self.set_router
  • self.set_ports
  • self.set_services
  • end function
  • Nmap.set_router = function()
  • if self.is_lan then
  • self.router = get_router;
  • else
  • self.router = get_router(self.ip)
  • end if
  • if self.router == null then exit("nmap: ip address not found")
  • end function
  • Nmap.set_ports = function()
  • if not self.is_lan then
  • self.ports = self.router.used_ports
  • else
  • self.ports = self.router.device_ports(self.ip)
  • end if
  • if self.ports == null then exit("nmap: ip address not found")
  • if typeof(self.ports) == "string" then exit(self.ports)
  • end function
  • Nmap.set_services = function()
  • scope = self
  • port_to_service = function(port)
  • service = new Service
  • service.init(self, port)
  • service.init(scope, port)
  • return service
  • end function
  • self.services = map(self.ports, @port_to_service)
  • end function
libs/scan.src
  • map = function(list, func)
  • result = list[0:] //list copy.
  • for i in indexes(list)
  • result[i] = func(result[i])
  • end for
  • return result
  • end function
  • _or = function(value1, value2)
  • if value1 == null or value1 == false then
  • return value2
  • end if
  • return value1
  • end function
  • // converts scan_address output to a list easier to process
  • // usage example:
  • // mem_scan = metaxploit.scan_address(metaLib, entry)
  • // mem_scan = mem_scan_exploits(mem_scan)
  • mem_scan_exploits = function(mem_scan)
  • ex_list = []
  • while true
  • ex_mark = mem_scan.indexOf("<b>")
  • if ex_mark == null then break
  • // get exploit value
  • ex_mark_end = mem_scan.indexOf("</b>")
  • value = slice(mem_scan, ex_mark+3, ex_mark_end)
  • // get requirements
  • mem_scan = mem_scan[ex_mark_end+5:]
  • mem_scan = mem_scan[mem_scan.indexOf(".")+1:]
  • mem_scan_lines = mem_scan.split(char(10))[1:]
  • if mem_scan_lines[0].indexOf("*") != null then
  • req = mem_scan_lines[:mem_scan_lines.indexOf("")]
  • else
  • req = []
  • end if
  • if req.len >= 1 then
  • mem_scan = mem_scan[mem_scan.indexOf(req[-1])+req[-1].len+1:]
  • end if
  • exploit = [value, req]
  • //["exploit_name": ["requirement", "requirement"]]
  • ex_list.push(exploit)
  • end while
  • return ex_list
  • //[
  • // {"exploit_name": ["requirement", "requirement"]},
  • // {"exploit_name": ["requirement", "requirement"]}
  • //]
  • end function
  • ScanExploit = {}
  • // ScanExploit.address : "0x62AC77E1"
  • // ScanExploit.value : "applyund"
  • // ScanExploit.requirements : ["* req1", "* req2"]
  • // ScanExploit.result :shell, computer, number, null, file object
  • // ScanExploit.result_info : string with description why the exploit failed
  • ScanExploit.init = function(options)
  • self.address = options.address
  • self.value = options.value
  • self.requirements = options.requirements
  • end function
  • ScanExploit.get_result = function()
  • try_exploit(entry, exploit[0])
  • end function
  • Scan = {}
  • Scan.metaxploit = null
  • // include_lib metaxploit
  • Scan.lib_path = null
  • Scan.extra_param = null
  • Scan.show_null = false
  • Scan.lib_file = null
  • Scan.net_session = null
  • Scan.shell = get_shell
  • Scan.computer = Scan.shell.host_computer
  • Scan.meta_lib = null
  • Scan.lib_name = null
  • Scan.lib_version = null
  • Scan.exploits = []
  • // ip "17.233.32.41", port 22
  • Scan.init = function(ip, port)
  • self.ip = ip
  • self.port = port
  • if self.ip != null then
  • self.net_session = _or(self.metaxploit.net_use(self.ip, self.port), self.metaxploit.net_use(self.ip))
  • else
  • self.lib_file = self.computer.File(self.lib_path)
  • end if
  • end function
  • Scan.execute = function()
  • if self.lib_file != null then
  • self.meta_lib = metaxploit.load(self.lib_file.path)
  • else
  • self.meta_lib = self.net_session.dump_lib
  • end if
  • self.lib_name = self.meta_lib.lib_name
  • self.lib_version = self.meta_lib.version
  • self.addresses = self.metaxploit.scan(self.meta_lib)
  • // ["0x62AC77E1", "0x50D166E8", "0x611B6063", "0x1A9FD00C"]
  • self.get_exploits
  • end function
  • Scan.get_exploits = function()
  • scope = self
  • get_values = function(address)
  • exploits_text = self.metaxploit.scan_address(self.meta_lib, address)
  • exploits_text = scope.metaxploit.scan_address(scope.meta_lib, address)
  • exploits_values = mem_scan_exploits(exploits_text)
  • return [address, exploits_values]
  • end function
  • self.exploits = map(self.addresses, @get_values)
  • // [0x611B6063, [[applyund, [* req1, * req2]], ...], ...], ...}]
  • result = []
  • for exploit_values in self.exploits
  • for value in exploit_values[1]
  • exploit = new ScanExploit
  • exploit.init({"address": exploit_values[0], "value": value[0], "requirements": value[1]})
  • result.push(exploit)
  • end for
  • end for
  • return result
  • //self.exploits = []
  • end function