Files

libs/scan.src
  • lmap = function(list, func)
  • result = list[0:] //list copy.
  • for i in indexes(list)
  • result[i] = func(result[i])
  • end for
  • return result
  • end function
  • _or = function(value1, value2)
  • if value1 == null or value1 == false then
  • return value2
  • end if
  • return value1
  • end function
  • // converts scan_address output to a list easier to process
  • // usage example:
  • // mem_scan = metaxploit.scan_address(metaLib, entry)
  • // mem_scan = mem_scan_exploits(mem_scan)
  • mem_scan_exploits = function(mem_scan)
  • ex_list = []
  • while true
  • ex_mark = mem_scan.indexOf("<b>")
  • if ex_mark == null then break
  • // get exploit value
  • ex_mark_end = mem_scan.indexOf("</b>")
  • value = slice(mem_scan, ex_mark+3, ex_mark_end)
  • // get requirements
  • mem_scan = mem_scan[ex_mark_end+5:]
  • mem_scan = mem_scan[mem_scan.indexOf(".")+1:]
  • mem_scan_lines = mem_scan.split(char(10))[1:]
  • if mem_scan_lines[0].indexOf("*") != null then
  • req = mem_scan_lines[:mem_scan_lines.indexOf("")]
  • else
  • req = []
  • end if
  • if req.len >= 1 then
  • mem_scan = mem_scan[mem_scan.indexOf(req[-1])+req[-1].len+1:]
  • end if
  • exploit = [value, req]
  • //["exploit_name": ["requirement", "requirement"]]
  • ex_list.push(exploit)
  • end while
  • return ex_list
  • //[
  • // {"exploit_name": ["requirement", "requirement"]},
  • // {"exploit_name": ["requirement", "requirement"]}
  • //]
  • end function
  • ScanExploitResult = {}
  • // ScanExploitResult.obj : result obj
  • // ScanExploitResult.info : string containing result info
  • ScanExploitResult.attrs = ["obj", "info"]
  • ScanExploitResult.init = function(obj, extra_param = null)
  • self.obj = obj
  • self.extra_param = extra_param
  • end function
  • ScanExploitResult.check_user = function(computer)
  • if computer.touch("/home/guest", "anonymous.dat") then
  • file = computer.File("/home/guest/anonymous.dat")
  • return file.owner
  • end if
  • return "unknown"
  • end function
  • ScanExploitResult.check_permissions = function(computer)
  • out = ""
  • c_home = computer.File("/home")
  • if c_home != null and c_home.has_permission("r") then
  • out = out + " /home"
  • end if
  • c_passwd = computer.File("/etc/passwd")
  • if c_passwd != null and c_passwd.has_permission("r") then
  • out = out + " /etc/passwd"
  • end if
  • c_libs = computer.File("/lib")
  • if c_libs != null and c_libs.has_permission("r") then
  • out = out + " /lib"
  • end if
  • if out != "" then
  • out = "permission on" + out
  • end if
  • return out
  • end function
  • ScanExploitResult.set_info = function(extra_param = null)
  • out = ""
  • type = typeof(self.obj)
  • if type == "file" then
  • if self.obj.is_folder then
  • out = "folder"
  • end if
  • permission = " without permission"
  • if self.obj.has_permission("r") then permission = " with permission"
  • out = out + permission
  • out = out + " " + self.obj.path
  • end if
  • if type == "shell" or type == "computer" then
  • comp = self.obj
  • if type == "shell" then comp = self.obj.host_computer
  • user = self.check_user(comp)
  • out = out + user + " user"
  • out = out + " " + self.check_permissions(comp)
  • end if
  • if type == "number" then
  • out = out + self.obj
  • if extra_param == null then extra_param = "null"
  • out = out + " extra_param: " + extra_param
  • end if
  • self.info = out
  • end function
  • ScanExploit = {}
  • // ScanExploit.address : "0x62AC77E1"
  • // ScanExploit.value : "applyund"
  • // ScanExploit.requirements : ["* req1", "* req2"]
  • // ScanExploit.result :shell, computer, number, null, file object
  • // ScanExploit.result_class : result obj wrapped in a class with some useful methods
  • ScanExploit.attrs = ["requirements_len", "result"]
  • ScanExploit.init = function(scan, options)
  • self.scan = scan
  • self.address = options.address
  • self.value = options.value
  • self.requirements = options.requirements
  • self.requirements_len = self.requirements.len
  • end function
  • ScanExploit.set_result = function(extra_param = null)
  • result = self.scan.meta_lib.overflow(self.address, self.value)
  • if result == null then
  • if extra_param != null and extra_param != "" then
  • result = self.scan.meta_lib.overflow(self.address, self.value, extra_param)
  • end if
  • end if
  • self.result = result
  • self.result_class = new ScanExploitResult
  • self.result_class.init(result)
  • self.result_class.set_info(extra_param)
  • end function
  • Scan = {}
  • Scan.attrs = ["ip", "port", "lib_version", "lib_name"]
  • Scan.lib_path = null
  • Scan.lib_file = null
  • Scan.show_null = false
  • Scan.shell = get_shell
  • Scan.computer = Scan.shell.host_computer
  • // Scan.lib_file = null : local libe, set when scanning a local lib
  • // Scan.net_session : remote lib, set when scaning a remote ip
  • // Scan.metaxploit : required metaxploit lib obj
  • // Scan.meta_lib : set after running execute method
  • // Scan.lib_name : set after running execute method
  • // Scan.lib_version : set after running execute method
  • // Scan.exploits : list of all exploits found, set after execute method
  • Scan.init = function(ip, port)
  • self.ip = ip
  • self.port = port
  • if self.ip != null then
  • self.net_session = _or(self.metaxploit.net_use(self.ip, self.port), self.metaxploit.net_use(self.ip))
  • else
  • self.lib_file = self.computer.File(self.lib_path)
  • end if
  • self.set_lib
  • end function
  • Scan.execute = function()
  • Scan.set_lib = function()
  • if self.lib_file != null then
  • self.meta_lib = metaxploit.load(self.lib_file.path)
  • else
  • self.meta_lib = self.net_session.dump_lib
  • end if
  • self.lib_name = self.meta_lib.lib_name
  • self.lib_version = self.meta_lib.version
  • end function
  • Scan.execute = function()
  • self.addresses = self.metaxploit.scan(self.meta_lib)
  • // ["0x62AC77E1", "0x50D166E8", "0x611B6063", "0x1A9FD00C"]
  • self.get_exploits
  • end function
  • Scan.get_exploits = function()
  • scope = self
  • get_values = function(address)
  • exploits_text = scope.metaxploit.scan_address(scope.meta_lib, address)
  • exploits_values = mem_scan_exploits(exploits_text)
  • return [address, exploits_values]
  • end function
  • self.exploits = lmap(self.addresses, @get_values)
  • // [0x611B6063, [[applyund, [* req1, * req2]], ...], ...], ...}]
  • result = []
  • for exploit_values in self.exploits
  • for value in exploit_values[1]
  • exploit = new ScanExploit
  • exploit.init(self, {"address": exploit_values[0], "value": value[0], "requirements": value[1]})
  • result.push(exploit)
  • end for
  • end for
  • return result
  • //self.exploits = []
  • end function
libs/disk.src
  • MAX_FILE_CONTENT = 160000 // limited by the game
  • MAX_NESTED_FOLDERS = 16 // limited by the game
  • MAX_FILES = 249 // limited by the game
  • FOLDER_PER_BLOCK = 2
  • Block = {}
  • Block.init = function(disk, folder)
  • self.disk = disk
  • self.folder = folder
  • self.name = folder.name
  • self.path = folder.path
  • self.full_path = self.path + "/" + self.name
  • self.depth = self.path.split("/").len - 1
  • self.is_at_max_depth = self.depth == MAX_NESTED_FOLDERS
  • self.is_at_max_folders = self.folder.get_folders.len == FOLDER_PER_BLOCK
  • if self.folder.get_files.len == 0 then self.new_file
  • end function
  • Block.last_file = function()
  • return self.folder.get_files[-1]
  • end function
  • Block.new_file = function()
  • blob_name = "0"
  • if self.disk.blobs.len > 0 then blob_name = str(self.disk.blobs[-1].name.to_int + 1)
  • self.disk.computer.touch(self.path, blob_name)
  • self.disk.setup_blocks
  • end function
  • Block.is_full_of_folders = function()
  • if self.is_at_max_depth then
  • return true
  • else
  • if self.is_at_max_folders then
  • for f in self.folder.get_folders
  • n_block = new Block
  • n_block.init(self.disk, f)
  • if n_block.is_full_of_folders == false then return false
  • end for
  • return true
  • end if
  • return false
  • end if
  • end function
  • Disk = {}
  • Disk.init = function(data_folder_path = null, data_folder_name = ".disk")
  • self.shell = get_shell
  • self.computer = self.shell.host_computer
  • self.data_folder_path = data_folder_path
  • if self.data_folder_path == null then self.data_folder_path = home_dir
  • self.data_folder_name = data_folder_name
  • self.data_folder_full_path = self.data_folder_path + "/" + self.data_folder_name
  • self.computer.create_folder(self.data_folder_path, self.data_folder_name)
  • self.data_folder = self.computer.File(self.data_folder_full_path)
  • self.setup_blocks
  • // there is a bug in setup_blocks that when new_block.init creates a new file it will add it twice to blobs
  • // list so im calling this shit again :) instead of fixing it
  • self.setup_blocks
  • self.tape = ""
  • end function
  • Disk.setup_blocks = function()
  • self.blocks = []
  • self.blobs = []
  • self.computer.create_folder(self.data_folder_full_path, "blocks")
  • first_block_folder = self.computer.File(self.data_folder_full_path + "/blocks")
  • new_block = new Block
  • new_block.init(self, first_block_folder)
  • self.load_blocks(new_block)
  • end function
  • // this wont check for blocks already loaded and will load them again
  • Disk.load_blocks = function(block)
  • self.blocks.push(block)
  • for f in block.folder.get_files
  • self.blobs.push(f)
  • end for
  • for f in block.folder.get_folders
  • new_block = new Block
  • new_block.init(self, f)
  • self.load_blocks(new_block)
  • end for
  • end function
  • Disk.create_new_block = function(block = null)
  • if block == null then block = self.blocks[0]
  • count = self.blocks[-1].name.to_int + 1
  • if self.blocks[-1].name == "blocks" then count = 1
  • if block.folder.get_folders.len == 0 then
  • self.computer.create_folder(block.path, str(count))
  • self.setup_blocks
  • return 1
  • else
  • for f in block.folder.get_folders
  • n_block = new Block
  • n_block.init(block.disk, f)
  • if n_block.is_full_of_folders then continue
  • self.create_new_block(n_block)
  • self.setup_blocks
  • return 1
  • end for
  • self.computer.create_folder(block.path, str(count))
  • self.setup_blocks
  • return 1
  • end if
  • end function
  • Disk.last_block = function()
  • b = self.blocks[-1]
  • if MAX_FILES - b.folder.get_files.len < MAX_FILES then
  • return b
  • end if
  • if b.folder.get_files[-1].get_content.len == MAX_FILE_CONTENT then
  • self.create_new_block
  • return self.blocks[-1]
  • end if
  • end function
  • Disk.last_blob = function()
  • b = self.last_block
  • if b.last_file.get_content.len == MAX_FILE_CONTENT then
  • b.new_file
  • return b.last_file
  • else
  • return b.last_file
  • end if
  • end function
  • Disk.last_char_index = function()
  • return (self.last_blob.get_content.len + (self.blobs.len - 1) * MAX_FILE_CONTENT)
  • end function
  • Disk.write = function(string)
  • self.update(self.last_char_index, string)
  • end function
  • Disk.updated_blob_content = function(content, offset, string)
  • content_to_left = content[:offset]
  • content_in_middle = string
  • content_to_right = content[offset + string.len:]
  • // do not remove the ""
  • return "" + content_to_left + content_in_middle + content_to_right
  • end function
  • Disk.update = function(offset, string)
  • blob_index = floor(offset / MAX_FILE_CONTENT)
  • inner_offset = offset % MAX_FILE_CONTENT
  • available_chars = MAX_FILE_CONTENT - inner_offset
  • if (self.blobs.hasIndex(blob_index) == false and inner_offset == 0 and self.blobs.len == blob_index) then
  • if self.blobs[-1].get_content.len < MAX_FILE_CONTENT then exit("error offset out of range")
  • self.last_block.new_file
  • end if
  • if (self.blobs.hasIndex(blob_index) == false) then exit("error offset out of range")
  • blob = self.blobs[blob_index]
  • if (blob.get_content.len < inner_offset) then exit("error offset out of range")
  • if string.len >= available_chars then
  • chars_to_write = string[:available_chars]
  • chars_left = string[(string.len - available_chars) * -1:]
  • blob.set_content(self.updated_blob_content(blob.get_content, inner_offset, chars_to_write))
  • new_offset = offset + chars_to_write.len
  • self.update(new_offset, chars_left)
  • else
  • blob.set_content(self.updated_blob_content(blob.get_content, inner_offset, string))
  • end if
  • end function
  • // TODO: make this function load only the necessary files and finish the offset feature
  • Disk.read_chars = function(start_offset = 0, end_offset = -1)
  • string = ""
  • for blob in self.blobs
  • string = string + blob.get_content
  • end for
  • return string
  • end function
  • Disk.nuke = function()
  • for b in self.blobs
  • b.delete
  • end for
  • self.setup_blocks
  • self.setup_blocks
  • end function
libs/list.src
  • map.to_list = function(shallow = false)
  • list = []
  • for i in self.indexes
  • if typeof(self[i]) == "map" then
  • if shallow == true then
  • list.push([i, self[i]])
  • else
  • list.push([i, self[i].to_list])
  • end if
  • else
  • list.push([i, self[i]])
  • end if
  • end for
  • return list
  • end function
  • list.to_map = function()
  • l = self[0:]
  • map = {}
  • for i in indexes(l)
  • if typeof(l[i][1]) == "list" and l[i][1].len == 2 and typeof(l[i][1][0]) == "string" then
  • map[l[i][0]] = l[i][1].to_map
  • else
  • map[l[i][0]] = l[i][1]
  • end if
  • end for
  • return map
  • end function
  • list.each = function(func)
  • result = self[0:] //list copy.
  • for i in indexes(self)
  • func(result[i])
  • end for
  • end function
  • map.each = function(func)
  • list = self.to_list(true)
  • result = list[0:] //list copy.
  • for i in indexes(list)
  • func(result[i][0], result[i][1])
  • end for
  • end function
  • list.map = function(func)
  • result = self[0:] //list copy.
  • for i in indexes(self)
  • result[i] = func(result[i])
  • end for
  • return result
  • end function
  • list.reject = function(func)
  • result = self[0:] //list copy.
  • i = 0
  • while i < result.len
  • if func(result[i]) == true then
  • result.remove(i)
  • continue
  • end if
  • i = i + 1
  • end while
  • return result
  • end function
  • list.select = function(func)
  • f = function(o)
  • return not func(o)
  • end function
  • return self.reject(@f)
  • end function
  • // do not rename funcc to to func it will infinite loop
  • list.lsort = function(funcc)
  • f = function(i)
  • return {"sort_key": funcc(i), "obj": i}
  • end function
  • result = self.map(@f)
  • result = result.sort("sort_key")
  • f = function(i)
  • return i["obj"]
  • end function
  • return result.map(@f)
  • end function
  • list.flat = function()
  • result = []
  • for i in self
  • if typeof(i) == "list" then
  • result = result + i.flat
  • else
  • result.push(i)
  • end if
  • end for
  • return result
  • end function
  • list.compact = function()
  • r = []
  • for i in self
  • if i != null then r.push(i)
  • if i != null and i != "" then r.push(i)
  • end for
  • return r
  • end function
  • list.uniq = function()
  • result = []
  • for i in self
  • if result.indexOf(i) == null then result.push(i)
  • end for
  • return result
  • end function
  • list.has_any = function(value)
  • for i in self
  • if i == value then return true
  • end for
  • return false
  • end function
  • list.min = function()
  • min = self[0]
  • for item in self
  • if item < min then
  • min = item
  • end if
  • end for
  • return min
  • end function
  • list.max = function()
  • max = self[0]
  • for item in self
  • if item > max then
  • max = item
  • end if
  • end for
  • return max
  • end function
libs/nmap.src
  • lmap = function(list, func)
  • result = list[0:] //list copy.
  • for i in indexes(list)
  • result[i] = func(result[i])
  • end for
  • return result
  • end function
  • Service = {}
  • // port : port number
  • // lan_ip
  • // info : service name and version
  • // port_obj : port obj
  • // version_to_int : int of 3 digits
  • Service.attrs = ["port", "status", "lan_ip", "info"]
  • Service.init = function(nmap, port = null)
  • self.nmap = nmap
  • if port == null then
  • self.port_obj = null
  • self.port = null
  • self.status = null
  • self.info = "router " + self.nmap.router.kernel_version
  • self.lan_ip = self.nmap.router.local_ip
  • else
  • self.port_obj = port
  • self.port = self.port_obj.port_number
  • self.status = "open"
  • if(self.port_obj.is_closed and not self.nmap.is_lan) then
  • self.status = "closed"
  • end if
  • self.info = self.nmap.router.port_info(self.port_obj)
  • self.lan_ip = self.port_obj.get_lan_ip
  • end if
  • self.version_to_int = self.info.split(" ")[1].split(".").join("").to_int
  • end function
  • Service.lib_dict = {"router": "kernel_router.so", "http": "libhttp.so", "ssh": "libssh.so", "repository": "librepository.so"}
  • Service.info_to_key = function()
  • return self.info.replace(".", "").replace(" ", "")
  • end function
  • Nmap = {}
  • Nmap.init = function(ip)
  • self.ip = ip
  • if not is_valid_ip(self.ip) then exit("nmap: invalid ip address")
  • self.is_lan = is_lan_ip(self.ip)
  • self.set_router
  • self.set_ports
  • self.set_services
  • end function
  • Nmap.set_router = function()
  • if self.is_lan then
  • self.router = get_router;
  • else
  • self.router = get_router(self.ip)
  • end if
  • if self.router == null then exit("nmap: ip address not found")
  • end function
  • Nmap.set_ports = function()
  • if not self.is_lan then
  • self.ports = self.router.used_ports
  • else
  • self.ports = self.router.device_ports(self.ip)
  • end if
  • if self.ports == null then exit("nmap: ip address not found")
  • if typeof(self.ports) == "string" then exit(self.ports)
  • end function
  • Nmap.set_services = function()
  • scope = self
  • port_to_service = function(port)
  • service = new Service
  • service.init(scope, port)
  • return service
  • end function
  • self.services = lmap(self.ports, @port_to_service)
  • service = new Service
  • service.init(scope)
  • self.services.push service
  • end function
src/machine.src
  • MachineServices = {}
  • MachineServices = {}
  • //class eval shit
  • exploits_inspect = function(obj, scope)
  • exploits_len = 0
  • if scope.hasIndex("exploits") then exploits_len = scope.exploits.len
  • return scope.exploits.len
  • end function
  • Service.attrs.push("exploits")
  • Service.set_exploits = function()
  • self.scan = new Scan
  • self.scan.init(self.nmap.ip, self.port)
  • self.scan.execute
  • self.exploits = self.scan.get_exploits
  • exploits = self.machine.json.to_object(self.machine.exploits_disk.read_chars)
  • if exploits.hasIndex(self.info_to_key) then
  • self.scan = new Scan
  • self.scan.init(self.nmap.ip, self.port)
  • self.exploits = []
  • for x in exploits[self.info_to_key]
  • exploit = new ScanExploit
  • exploit.init(self.scan, x)
  • self.exploits.push(exploit)
  • end for
  • else
  • self.scan = new Scan
  • self.scan.init(self.nmap.ip, self.port)
  • self.scan.execute
  • self.exploits = self.scan.get_exploits
  • end if
  • end function
  • // require passwords list set in custom_object
  • Service.quick_root_shell = function(attack_script)
  • for x in self.exploits
  • x.set_result
  • if typeof(x.result) != "shell" then continue
  • if typeof(x.result) != "shell" then continue
  • remote_shell = x.result
  • remote_comp = remote_shell.host_computer
  • if remote_comp.File("/home/guest/tableAttack.src") != null then
  • remote_comp.File("/home/guest/tableAttack.src").delete
  • end if
  • remote_comp.touch("/home/guest", "tableAttack.src")
  • remote_comp.File("/home/guest/tableAttack.src").set_content(attack_script.get_content)
  • print "building script"
  • remote_shell.build("/home/guest/tableAttack.src", "/home/guest")
  • remote_shell.launch("/home/guest/tableAttack")
  • root_shell = get_custom_object.shell
  • return root_shell
  • end for
  • return null
  • end function
  • Machine = {}
  • //Machine.passwords_list : required passwords list
  • //Machine.table_attack_script : required table attack script
  • Machine.services_inspect = function(obj, scope)
  • f = function(o)
  • exploits_len = 0
  • if o.hasIndex("exploits") then exploits_len = o.exploits.len
  • return o.inspect(["info", [exploits_len, "exploits_len"], "port"])
  • end function
  • return scope.services.map(@f)
  • end function
  • Machine.attrs = ["ip", [@Machine.services_inspect, "services"]]
  • Machine.metaxploit = null //required
  • Machine.init = function(ip, passwords)
  • Machine.init = function(ip, passwords_disk, exploits_disk)
  • self.ip = ip
  • self.set_services
  • self.passwords = passwords
  • self.passwords_disk = passwords_disk
  • self.passwords = self.passwords_disk.read_chars.split(char(10))
  • self.exploits_disk = exploits_disk
  • if self.exploits_disk.read_chars.len == 0 then
  • self.exploits_disk.write("{}")
  • end if
  • self.json = new JSON
  • if not get_custom_object.hasIndex("passwords") then
  • get_custom_object.passwords = self.passwords
  • end if
  • end function
  • Machine.quick_attack = function(only_routers = true)
  • Machine.save_exploits = function()
  • for s in self.services
  • key = s.info_to_key
  • exploits = []
  • if s.hasIndex("exploits") == 0 then continue
  • for x in s.exploits
  • x_obj = {}
  • x_obj["address"] = x.address
  • x_obj["value"] = x.value
  • x_obj["requirements"] = x.requirements
  • x_obj["requirements_len"] = x.requirements_len
  • if x.hasIndex("result") == 1 then x_obj["result"] = typeof(x.result)
  • exploits.push x_obj
  • end for
  • exploits_db = self.json.to_object(self.exploits_disk.read_chars)
  • exploits_db[key] = exploits
  • self.exploits_disk.nuke
  • self.exploits_disk.write(self.json.to_string(exploits_db))
  • end for
  • end function
  • Machine.quick_attack = function(only_routers = true, table_attack_script)
  • target_services = self.services
  • if only_routers == true then
  • f = function(o)
  • return o.port == null
  • end function
  • target_services.map(@f)
  • end if
  • for service in target_services
  • service.set_exploits
  • root_shell = service.quick_root_shell(self.passwords_list, self.table_attack_script)
  • root_shell = service.quick_root_shell(table_attack_script)
  • if typeof(root_shell) == "shell" then return root_shell
  • end for
  • return null
  • end function
  • Machine.random_ip = function()
  • first_byte_range = range(0, 255)
  • first_byte_range.remove(192) //reserved
  • first_byte_range.remove(191) //reserved
  • first_byte_range.remove(0) //reserved
  • first_byte_range.remove(10) //private
  • first_byte_range.remove(172) //private
  • first_byte_range.remove(128) //reserved
  • first_byte_range.remove(223) //reserved
  • rest_byte_range = range(0,255)
  • ip = []
  • ip.push(floor(rnd() * first_byte_range.len))
  • for i in range(2)
  • ip.push(floor(rnd() * rest_byte_range.len))
  • end for
  • ip = ip.join(".")
  • if is_valid_ip(ip) and get_router(ip) and get_shell.ping(ip) then
  • return ip
  • end if
  • return self.random_ip
  • end function
  • Machine.set_services = function()
  • self.nmap = new Nmap
  • self.nmap.init(self.ip)
  • self.nmap.machine = self
  • self.services = self.nmap.services
  • for s in self.services
  • s.machine = self
  • end for
  • end function
  • // this will get more complicated later on, i want to choose a port that i have the most change of getting in
  • // so i can check a database of exploits see or see the local ip with most ports open etc
  • Machine.most_vulnerable_service = function()
  • if self.services.len == 1 then return self.services[0]
  • if self.services.len == 0 then return null
  • with_smallest_version = self.services[0]
  • for service in self.services[1:]
  • if service.version_to_int < with_smallest_version.version_to_int then
  • with_smallest_version = service
  • end if
  • end for
  • return with_smallest_version
  • end function
cli/libfish.src
  • import_code("/home/me/h/src/utils.src") // exports map.inspect, p
  • import_code("/home/me/h/libs/list.src") // exports list utils and map utils
  • import_code("/home/me/h/libs/disk.src") // exports Disk, Block
  • import_code("/home/me/h/libs/nmap.src") // exports Nmap, Service
  • import_code("/home/me/h/libs/scan.src") // exports Scan
  • import_code("/home/me/h/src/machine.src") // exports Machine, MachineService, depends on Scan, Nmap
  • import_code("/home/me/h/libs/json.src") // exports Json
  • import_code("/home/me/h/src/machine.src") // exports Machine, MachineService, depends on Scan, Nmap , Json
  • import_code("/home/me/h/libs/meta.src") // exports Meta
  • import_code("/home/me/h/src/shell.src") // extend map
  • TABLEATTACK_SCRIPT = get_shell.host_computer.File(home_dir + "/Config/tableAttack.src")
  • EMPTY_LOG_PATH = home_dir + "/Config/emptyLog"
  • PASSWORDS_DISK = new Disk
  • PASSWORDS_DISK.init(home_dir + "/Config", "passwords")
  • LIBS_DISK = new Disk
  • LIBS_DISK.init(home_dir + "/Config", "libsDB")
  • EXPLOITS_DISK = new Disk
  • EXPLOITS_DISK.init(home_dir + "/Config", "exploits")
  • LIB_STORE_PATH = home_dir + "/Config/libs"
  • Machine.metaxploit = include_lib("/lib/metaxploit.so")
  • Scan.metaxploit = include_lib("/lib/metaxploit.so")
  • fish_lib = {"router": "kernel_router.so", "http": "libhttp.so", "ssh": "libssh.so", "repository": "librepository.so"}
  • Command = {}
  • Command.libfish_sig = {}
  • Command.libfish_sig["description"] = "hack random npcs to find libs"
  • lib_param_desc = []
  • lib_param_desc.push "libs to search for, if this param is present the command will only search for the specific libs passed "
  • lib_param_desc.push "but you can pass as many lib names as you want, the valid params are: "
  • lib_param_desc.push fish_lib.indexes.join(", ")
  • lib_param_desc.push Service.lib_dict.indexes.join(", ")
  • lib_param_desc = lib_param_desc.join("")
  • Command.libfish_sig["args"] = [["lib", lib_param_desc]]
  • Command.libfish_sig["options"] = []
  • Command.libfish = function(args = [], options = {})
  • if args.len > 0 then
  • for arg in args
  • if fish_lib.hasIndex(arg) == 0 then exit("invalid param, look at the docs")
  • if Service.lib_dict.hasIndex(arg) == 0 then exit("invalid param, look at the docs")
  • end for
  • for i in fish_lib.indexes
  • if args.indexOf(i) == null then fish_lib.remove(i)
  • for i in Service.lib_dict.indexes
  • if args.indexOf(i) == null then Service.lib_dict.remove(i)
  • end for
  • end if
  • //print fish_lib
  • while true
  • machine = new Machine
  • machine.init(machine.random_ip, PASSWORDS_DISK.read_chars.split(char(10)))
  • machine.init(machine.random_ip, PASSWORDS_DISK, EXPLOITS_DISK)
  • for s in machine.services
  • known_libs = get_shell.host_computer.File(LIB_STORE_PATH).get_files
  • for i in known_libs.indexes
  • known_libs[i] = known_libs[i].name
  • end for
  • s.set_exploits
  • if not fish_lib.hasIndex(s.info.split(" ")[0]) then continue
  • if not Service.lib_dict.hasIndex(s.info.split(" ")[0]) then continue
  • key = s.info.replace(".", "").replace(" ", "")
  • if known_libs.indexOf(key) then continue
  • so_name = fish_lib[s.info.split(" ")[0]]
  • so_name = Service.lib_dict[s.info.split(" ")[0]]
  • sh = s.quick_root_shell(TABLEATTACK_SCRIPT)
  • if typeof(sh) != "shell" then continue
  • sh.scp("/lib/" + so_name, LIB_STORE_PATH, get_shell)
  • //sh.clear_logs(EMPTY_LOG_PATH)
  • sh.clear_logs(EMPTY_LOG_PATH)
  • get_shell.host_computer.File(LIB_STORE_PATH + "/" + so_name).rename(key)
  • end for
  • end while
  • end function
  • import_code("/home/me/h/libs/thor.src") //depends on Listlib, exports Thor
  • Thor.init(Command, "libfish")
cli/proxy.src
  • import_code("/home/me/h/src/utils.src") // exports map.inspect, p
  • import_code("/home/me/h/libs/list.src") // exports list utils and map utils
  • import_code("/home/me/h/libs/disk.src") // exports Disk, Block
  • import_code("/home/me/h/libs/nmap.src") // exports Nmap, Service
  • import_code("/home/me/h/libs/scan.src") // exports Scan
  • import_code("/home/me/h/libs/json.src") // exports Json
  • import_code("/home/me/h/src/machine.src") // exports Machine, MachineService, depends on Scan, Nmap , Json
  • import_code("/home/me/h/libs/meta.src") // exports Meta
  • import_code("/home/me/h/src/shell.src") // extend map
  • TABLEATTACK_SCRIPT = get_shell.host_computer.File(home_dir + "/Config/tableAttack.src")
  • EMPTY_LOG_PATH = home_dir + "/Config/emptyLog"
  • PASSWORDS_DISK = new Disk
  • PASSWORDS_DISK.init(home_dir + "/Config", "passwords")
  • EXPLOITS_DISK = new Disk
  • EXPLOITS_DISK.init(home_dir + "/Config", "exploits")
  • Machine.metaxploit = include_lib("/lib/metaxploit.so")
  • Scan.metaxploit = include_lib("/lib/metaxploit.so")
  • get_shell.host_computer.touch(home_dir + "/Config", "proxy.txt")
  • PROXY_FILE = get_shell.host_computer.File(home_dir + "/Config/proxy.txt")
  • Command = {}
  • Command.proxy_sig = {}
  • Command.proxy_sig["description"] = "hack a random router to use to hide you ip"
  • Command.proxy_sig["args"] = []
  • Command.proxy_sig["options"] = []
  • Command.proxy = function(args = [], options = {})
  • proxies = PROXY_FILE.get_content.split(char(10)).compact
  • if proxies.len > 0 then
  • print "you arealdy have hacked proxies, do you want to reuse them?" + char(10)
  • for i in proxies.indexes
  • print "[" + i + "] " + proxies[i]
  • end for
  • print "[" + proxies.len + "] hack a new one"
  • option = user_input("select a option: ")
  • if proxies.hasIndex(option) then
  • machine = new Machine
  • machine.init(proxies[option], PASSWORDS_DISK, EXPLOITS_DISK)
  • root_shell = machine.quick_attack(true, TABLEATTACK_SCRIPT)
  • root_shell.clear_logs(EMPTY_LOG_PATH)
  • root_shell.start_terminal
  • end if
  • end if
  • while true
  • machine = new Machine
  • machine.init(machine.random_ip, PASSWORDS_DISK, EXPLOITS_DISK)
  • root_shell = machine.quick_attack(true, TABLEATTACK_SCRIPT)
  • if root_shell == null then continue
  • PROXY_FILE.set_content(PROXY_FILE.get_content + char(10) + machine.ip)
  • machine.save_exploits
  • root_shell.clear_logs(EMPTY_LOG_PATH)
  • root_shell.start_terminal
  • end while
  • end function
  • import_code("/home/me/h/libs/thor.src") //depends on Listlib, exports Thor
  • Thor.init(Command, "proxy")
libs/json.src
  • //This implementation deviates from RFC 7159 - The JavaScript Object Notation (JSON) Data Interchange Format <https://tools.ietf.org/html/rfc7159> in the following ways:
  • //Section 6 (Numbers):
  • // Leading zeros are allowed
  • // Infinity, -Infinity, NaN are considered valid numbers
  • //Section 7 (Strings):
  • // Escaping characters is not implemented
  • // Literal double quote is represented as "" in a string
  • //usage:
  • //json = new JSON
  • //string = json.to_string(object)
  • //object = json.to_object(string)
  • JSON = {}
  • JSON.JSON_QUOTE = """"
  • JSON.JSON_WHITESPACE = [char(9), char(10), char(13), char(32)] //[TAB, LF, CR, Space]
  • JSON.JSON_SYNTAX = [",",":","[","]","{","}"]
  • JSON.NUMBER_SYNTAX = ["-","+","E","e","."]
  • JSON.NULL = null
  • JSON.sLexString=function(string)
  • if string[0] == self.JSON_QUOTE then
  • string = string[1:]
  • else
  • return [self.NULL, string]
  • end if
  • json_string = ""
  • strlen = string.len
  • if strlen > 0 then
  • i = 0
  • while i < strlen
  • if string[i] == "\" and string[i+1] == self.JSON_QUOTE then
  • i = i + 2
  • json_string = json_string + self.JSON_QUOTE
  • continue
  • end if
  • if string[i] == self.JSON_QUOTE then
  • i = i + 1
  • return [json_string, string[i:]]
  • end if
  • json_string = json_string + string[i]
  • i = i + 1
  • end while
  • end if
  • exit("<color=#ff0000>JSON string lexer error: Expected end-of-string quote")
  • end function
  • JSON.sLexNumber=function(string)
  • strlen = string.len
  • if strlen > 8 and string[:9] == "-Infinity" then
  • return ["-Infinity".val, string[9:]]
  • else if strlen > 7 and string[:8] == "Infinity" then
  • return ["Infinity".val, string[8:]]
  • else if strlen > 2 and string[:3] == "NaN" then
  • return ["NaN".val, string[3:]]
  • end if
  • json_number = ""
  • for c in string
  • if (c.code > 47 and c.code < 58) or self.NUMBER_SYNTAX.indexOf(c) != null then
  • json_number = json_number + c
  • else
  • break
  • end if
  • end for
  • number = json_number.val
  • if number == 0 and json_number != "0" then return [self.NULL, string]
  • return [number, string[json_number.len:]]
  • end function
  • JSON.sLexBool=function(string)
  • strlen=string.len
  • if strlen > 3 and string[:4] == "true" then return [true, string[4:]]
  • if strlen > 4 and string[:5] == "false" then return [false, string[5:]]
  • return [self.NULL, string]
  • end function
  • JSON.sLexNull=function(string)
  • if string.len > 3 and string[:4] == "null" then return [true, string[4:]]
  • return [false, string]
  • end function
  • JSON.sLexWhitespace=function(string)
  • if self.JSON_WHITESPACE.indexOf(string[0]) != null then
  • return [string[0], string[1:]]
  • end if
  • return [self.NULL, string]
  • end function
  • JSON.sLexSyntax=function(string)
  • if self.JSON_SYNTAX.indexOf(string[0]) != null then
  • return [string[0], string[1:]]
  • end if
  • return [self.NULL, string]
  • end function
  • JSON.sLex=function(string)
  • tokens = []
  • while string
  • res = self.sLexString(string)
  • if res[0] != null then
  • tokens.push({"token":"string","value":res[0]})
  • string=res[1]
  • continue
  • end if
  • res = self.sLexNumber(string)
  • if res[0] != null then
  • tokens.push({"token":"number","value":res[0]})
  • string=res[1]
  • continue
  • end if
  • res = self.sLexBool(string)
  • if res[0] != null then
  • tokens.push({"token":"bool","value":res[0]})
  • string=res[1]
  • continue
  • end if
  • res = self.sLexNull(string)
  • if res[0] == true then
  • tokens.push({"token":"null","value":self.NULL})
  • string=res[1]
  • continue
  • end if
  • res = self.sLexSyntax(string)
  • if res[0] != null then
  • tokens.push({"token":"syntax","value":res[0]})
  • string=res[1]
  • continue
  • end if
  • res = self.sLexWhitespace(string)
  • if res[0] != null then
  • string=res[1]
  • continue
  • end if
  • exit("<color=#ff0000>JSON lexer error: Unexpected character: "+string[0])
  • end while
  • return tokens
  • end function
  • JSON.sParseList=function(tokens)
  • if tokens[0] == {"token":"syntax","value":"]"} then return [[], tokens[1:]]
  • json_list = []
  • while tokens
  • res = self.sParse(tokens)
  • json_list.push(res[0])
  • tokens = res[1]
  • if tokens[0] == {"token":"syntax","value":"]"} then
  • return [json_list, tokens[1:]]
  • else if tokens[0] != {"token":"syntax","value":","} then
  • exit("<color=#ff0000>JSON parser error: Expected comma after object in list")
  • end if
  • tokens = tokens[1:]
  • end while
  • exit("<color=#ff0000>JSON list parser error: Expected end-of-list bracket")
  • end function
  • JSON.sParseMap=function(tokens)
  • if tokens[0] == {"token":"syntax","value":"}"} then return [{}, tokens[1:]]
  • json_map = {}
  • while tokens
  • if tokens[0].token == "string" or tokens[0].token == "number" then
  • json_key = tokens[0].value
  • tokens = tokens[1:]
  • else
  • exit("<color=#ff0000>JSON map parser error: Expected string or number key, got: "+tokens[0])
  • end if
  • if tokens[0] != {"token":"syntax","value":":"} then
  • exit("<color=#ff0000>JSON map parser error: Expected "":"" after key in map, got: "+tokens[0])
  • end if
  • res = self.sParse(tokens[1:])
  • json_map[json_key]=res[0]
  • tokens=res[1]
  • if tokens[0] == {"token":"syntax","value":"}"} then
  • return [json_map, tokens[1:]]
  • else if tokens[0] != {"token":"syntax","value":","} then
  • exit("<color=#ff0000>JSON map parser error: Expected "","" after pair in map, got: "+tokens[0])
  • end if
  • tokens = tokens[1:]
  • end while
  • exit("<color=#ff0000>JSON map parser error: Expected end-of-map brace")
  • end function
  • JSON.sParse=function(tokens)
  • if tokens then
  • if tokens[0] == {"token":"syntax","value":"["} then
  • return self.sParseList(tokens[1:])
  • else if tokens[0] == {"token":"syntax","value":"{"} then
  • return self.sParseMap(tokens[1:])
  • end if
  • return [tokens[0].value, tokens[1:]]
  • end if
  • return null
  • end function
  • JSON.oParseList=function(list)
  • list_string = "["
  • listlen = list.len
  • if listlen then
  • if listlen > 1 then
  • for i in range(0,listlen-2)
  • list_string = list_string + self.to_string(list[i]) + ","
  • end for
  • end if
  • list_string = list_string + self.to_string(list[-1])
  • end if
  • return list_string + "]"
  • end function
  • JSON.oParseMap=function(map)
  • map_string = "{"
  • mapkeys = map.indexes
  • maplen = mapkeys.len
  • if maplen then
  • if maplen > 1 then
  • for i in range(0,maplen-2)
  • if typeof(mapkeys[i]) == "string" then
  • map_string = map_string + """" + mapkeys[i] + """" + ":" + self.to_string(map[mapkeys[i]]) + ","
  • else
  • map_string = map_string + mapkeys[i] + ":" + self.to_string(map[mapkeys[i]]) + ","
  • end if
  • end for
  • end if
  • if typeof(mapkeys[-1]) == "string" then
  • map_string = map_string + """" + mapkeys[-1] + """" + ":" + self.to_string(map[mapkeys[-1]])
  • else
  • map_string = map_string + mapkeys[-1] + ":" + self.to_string(map[mapkeys[-1]])
  • end if
  • end if
  • return map_string + "}"
  • end function
  • JSON.to_object=function(string)
  • return self.sParse(self.sLex(string))[0]
  • end function
  • JSON.to_string=function(object)
  • if typeof(object) == "string" then
  • return """" + object.replace("""", "\""") + """"
  • else if typeof(object) == "number" then
  • return str(object)
  • else if object == null then
  • return null
  • else if typeof(object) == "list" then
  • return self.oParseList(object)
  • else
  • return self.oParseMap(object)
  • end if
  • end function