Files
libs/thor.src
- ThorParam = {}
- ThorParam.init = function(obj)
- self.name = obj
- if obj isa list then self.name = obj[0]
- if obj isa map then self.name = obj.indexes[0]
- self.description = null
- if obj isa list then self.description = obj[1]
- if obj isa map then self.description = obj.values[1]
- self.is_required = self.name[-1] == "*"
- self.is_optional = not self.is_required
- end function
- ThorCommand = {}
- ThorCommand.init = function(func, sig, name)
- self.name = name
- self.func = @func
-
- if sig.hasIndex("description") then self.description = sig["description"]
-
- if sig.hasIndex("args") then
self.args = sig["args"]
- f = function(o)
- r = new ThorParam
- r.init(o)
- return r
- end function
-
- self.args = sig["args"].map(@f)
- end if
-
- if sig.hasIndex("options") then
- f = function(obj)
- param = {}
- param["name"] = obj.indexes[0]
- param["description"] = obj[obj.indexes[0]]
- return param
- end function
- self.options = sig["options"].map(@f)
- end if
- end function
- ThorCommand.required_args = function()
- f = function(obj)
return obj[-1:] == "*"
- return obj.is_required
- end function
- return self.args.select(@f)
- end function
- ThorCommand.optional_args = function()
- f = function(obj)
- return self.required_args.indexOf(obj) == null
- end function
- return self.args.select(@f)
- end function
- ThorCommand.options_list = function()
- f = function(o)
- return o.name
- end function
- return self.options.map(@f)
- end function
- ThorCommand.args_help = function()
- out = self.name
- for arg in self.args
out = out + " " + arg
- out = out + " " + arg.name
- end for
-
- f = function(o)
- return o.description != null
- end function
- args_with_description = self.args.select(@f)
- if args_with_description.len > 0 then
- out = out + char(10) * 2 + "args description:" + char(10)
-
- for arg in args_with_description
- out = out + arg.name + " : " + arg.description
- end for
- end if
-
- return out
- end function
- ThorCommand.options_help = function()
- out = "options for " + self.name + ":" + char(10)
- for i in self.options
- n = i.name
- if typeof(i.name) == "list" then n = i.name.join(" or ")
- out = out + n + " : " + i.description
- if self.options.indexOf(i) < self.options.len - 1 then out = out + char(10)
- end for
- return out
- end function
- ThorCommand.help = function()
- out = self.args_help + char(10) + char(10)
out = out + self.options_help + char(10) + char(10)
- if self.options_list.len > 0 then
- out = out + self.options_help + char(10) + char(10)
- end if
- out = out + "program description: " + char(10)
- out = out + self.description
- return out
- end function
- ThorCommand.exec = function()
self.func(self.passed_args, self.passed_options)
- self.func(self.passed_args.compact, self.passed_options)
- end function
- // class divider ---------------------------------------
- ThorManager = {}
- ThorManager.init = function(thor)
- self.thor = thor
- end function
- ThorManager.eval_command = function(command)
used_args = self.thor.global_args[:command.args.len]
self.thor.global_args = self.thor.global_args[command.args.len:]
- used_args = self.thor.global_args
- self.thor.global_args = self.thor.global_args
-
- self.thor.used_options = self.thor.used_options + command.options_list.flat
-
- for i in range(command.args.len - used_args.len - 1)
- used_args.push(null)
- end for
- command["passed_args"] = used_args
- command["passed_options"] = self.options_by_key(command)
-
- self.thor.global_execution_queue.push(command)
- end function
- ThorManager.options_by_key = function(command)
- scope = self
- r = {}
-
- get_value = function(o)
- if o.indexOf("=") then
- striped_options = scope.thor.striped_global_options
-
- if striped_options.indexOf(o) then
- value = scope.thor.global_options[striped_options.indexOf(o)]
- return value[value.indexOf("=")+1:]
- else
- return null
- end if
- else
- if scope.thor.global_options.indexOf(i) != null then return true
- return null
- end if
- end function
-
- for o in command.options_list
- if typeof(o) == "list" then
- v = null
- for i in o
- if get_value(i) != null then v = get_value(i)
- end for
- for i in o
- r[i] = v
- end for
- else
- r[o] = get_value(o)
- end if
- end for
- return r
- end function
- // class divider ---------------------------------------
- Thor = {}
- Thor.init = function(class, main_func_name)
- self.class = null
- self.global_args = []
- self.passed_args_count = 0
- self.global_options = []
- self.used_options = []
- self.global_execution_queue = []
-
- self.manager = new ThorManager
- self.manager.init(self)
-
- main_command = new ThorCommand
- main_command.init(class[main_func_name], class[main_func_name+"_sig"], main_func_name)
-
- self.params_to_args_options(params)
-
- self.manager.eval_command(main_command)
- self.catch_errors
- self.exec_queue
- end function
- Thor.striped_global_options = function()
- f = function(ob)
- if ob.indexOf("=") then
- return ob[:ob.indexOf("=")+1]
- end if
- end function
- return self.global_options.map(@f)
- end function
- Thor.params_to_args_options = function(params)
- // filter for args
- f = function(p)
- return p[0] == "-"
- end function
- args = params.reject(@f)
- options = {}
-
- f = function(param)
- return param[:1] == "-" and param.indexOf("=") == null
- end function
- params_options = params.select(@f)
-
- f = function(param)
- if param[:2] != "--" and param.len > 2 then
- r = []
- for i in param[1:].values
- r.push("-" + i)
- end for
- return r
- else
- return param
- end if
- end function
- params_options = params_options.map(@f).flat.uniq
-
- f = function(param)
- return param[:1] == "-" and param.indexOf("=") != null
- end function
- params_value_options = params.select(@f)
-
- options = params_options + params_value_options
-
- self.global_args = args
- self.passed_args_count = args.len
- self.global_options = options
- end function
- Thor.catch_errors = function()
- if self.global_options.indexOf("-h") != null or self.global_options.indexOf("--help") != null then
- print(self.global_execution_queue[-1].help)
- exit()
- end if
- f = function(c)
- return c.required_args.len
- end function
- required_args = self.global_execution_queue.map(@f)
-
- if self.passed_args_count < required_args.sum then
- print("error: required params not passed, check the docs")
- exit()
- end if
-
- used_options = self.used_options + ["-h", "--help"] //cant use self inside the block
- f = function(p)
- return used_options.indexOf(p) == null
- end function
- undefined_options = self.striped_global_options.select(@f)
-
- for i in undefined_options
- print("error: " + i + " option is not defined, check the docs")
- exit()
- end for
- end function
- Thor.exec_queue = function()
- self.global_execution_queue[-1].exec
- end function
src/machine.src
- MachineServices = {}
- //class eval shit
- exploits_inspect = function(obj, scope)
- exploits_len = 0
- if scope.hasIndex("exploits") then exploits_len = scope.exploits.len
- return scope.exploits.len
- end function
- Service.attrs.push("exploits")
- Service.set_exploits = function()
- self.scan = new Scan
- self.scan.init(self.nmap.ip, self.port)
- self.scan.execute
- self.exploits = self.scan.get_exploits
- end function
- // require passwords list set in custom_object
- Service.quick_root_shell = function(attack_script)
- for x in self.exploits
- x.set_result
- if typeof(x.result) != "shell" then continue
-
- remote_shell = x.result
- remote_comp = remote_shell.host_computer
-
- if remote_comp.File("/home/guest/tableAttack.src") != null then
- remote_comp.File("/home/guest/tableAttack.src").delete
- end if
-
- remote_comp.touch("/home/guest", "tableAttack.src")
- remote_comp.File("/home/guest/tableAttack.src").set_content(attack_script.get_content)
- print "building script"
- remote_shell.build("/home/guest/tableAttack.src", "/home/guest")
-
- remote_shell.launch("/home/guest/tableAttack")
- root_shell = get_custom_object.shell
- return root_shell
- end for
- return null
- end function
- Machine = {}
- //Machine.passwords_list : required passwords list
- //Machine.table_attack_script : required table attack script
- Machine.services_inspect = function(obj, scope)
- f = function(o)
- exploits_len = 0
- if o.hasIndex("exploits") then exploits_len = o.exploits.len
- return o.inspect(["info", [exploits_len, "exploits_len"], "port"])
- end function
-
- return scope.services.map(@f)
- end function
- Machine.attrs = ["ip", [@Machine.services_inspect, "services"]]
- Machine.metaxploit = null //required
- Machine.init = function(ip, passwords)
- self.ip = ip
- self.set_services
- self.passwords = passwords
get_custom_object.passwords = self.passwords
- if not get_custom_object.hasIndex("passwords") then
- get_custom_object.passwords = self.passwords
- end if
- end function
- Machine.quick_attack = function(only_routers = true)
- target_services = self.services
-
- if only_routers == true then
- f = function(o)
- return o.port == null
- end function
- target_services.map(@f)
- end if
-
- for service in target_services
- service.set_exploits
- root_shell = service.quick_root_shell(self.passwords_list, self.table_attack_script)
- if typeof(root_shell) == "shell" then return root_shell
- end for
- return null
- end function
- Machine.random_ip = function()
- first_byte_range = range(0, 255)
- first_byte_range.remove(192) //reserved
- first_byte_range.remove(191) //reserved
- first_byte_range.remove(0) //reserved
- first_byte_range.remove(10) //private
- first_byte_range.remove(172) //private
- first_byte_range.remove(128) //reserved
- first_byte_range.remove(223) //reserved
-
- rest_byte_range = range(0,255)
-
- ip = []
- ip.push(floor(rnd() * first_byte_range.len))
- for i in range(2)
- ip.push(floor(rnd() * rest_byte_range.len))
- end for
- ip = ip.join(".")
-
- if is_valid_ip(ip) and get_router(ip) and get_shell.ping(ip) then
- return ip
- end if
- return self.random_ip
- end function
- Machine.set_services = function()
- self.nmap = new Nmap
- self.nmap.init(self.ip)
-
- self.services = self.nmap.services
- end function
- // this will get more complicated later on, i want to choose a port that i have the most change of getting in
- // so i can check a database of exploits see or see the local ip with most ports open etc
- Machine.most_vulnerable_service = function()
- if self.services.len == 1 then return self.services[0]
- if self.services.len == 0 then return null
- with_smallest_version = self.services[0]
-
- for service in self.services[1:]
- if service.version_to_int < with_smallest_version.version_to_int then
- with_smallest_version = service
- end if
- end for
-
- return with_smallest_version
- end function
cli/libfish.src
import_code("/home/me/h/src/utils.src") // exports map.inspect, p
import_code("/home/me/h/libs/list.src") // exports list utils and map utils
import_code("/home/me/h/libs/disk.src") // exports Disk, Block
import_code("/home/me/h/libs/nmap.src") // exports Nmap, Service
import_code("/home/me/h/libs/scan.src") // exports Scan
import_code("/home/me/h/src/machine.src") // exports Machine, MachineService, depends on Scan, Nmap
import_code("/home/me/h/libs/meta.src") // exports Meta
import_code("/home/me/h/src/shell.src") // extend map
TABLEATTACK_SCRIPT = get_shell.host_computer.File(home_dir + "/Config/tableAttack.src")
EMPTY_LOG_PATH = home_dir + "/Config/emptyLog"
PASSWORDS_DISK = new Disk
PASSWORDS_DISK.init(home_dir + "/Config", "passwords")
LIBS_DISK = new Disk
LIBS_DISK.init(home_dir + "/Config", "libsDB")
LIB_STORE_PATH = home_dir + "/Config/libs"
Machine.metaxploit = include_lib("/lib/metaxploit.so")
Scan.metaxploit = include_lib("/lib/metaxploit.so")
fish_lib = {"router": "kernel_router.so", "http": "libhttp.so", "ssh": "libssh.so", "repository": "librepository.so"}
Command = {}
Command.libfish_sig = {}
Command.libfish_sig["description"] = "hack random npcs to find libs"
lib_param_desc = []
lib_param_desc.push "libs to search for, if this param is present the command will only search for the specific libs passed "
lib_param_desc.push "but you can pass as many lib names as you want, the valid params are: "
lib_param_desc.push fish_lib.indexes.join(", ")
lib_param_desc = lib_param_desc.join("")
Command.libfish_sig["args"] = [["lib", lib_param_desc]]
Command.libfish_sig["options"] = []
Command.libfish = function(args = [], options = {})
if args.len > 0 then
for arg in args
if fish_lib.hasIndex(arg) == 0 then exit("invalid param, look at the docs")
end for
for i in fish_lib.indexes
if args.indexOf(i) == null then fish_lib.remove(i)
end for
end if
//print fish_lib
while true
machine = new Machine
machine.init(machine.random_ip, PASSWORDS_DISK.read_chars.split(char(10)))
for s in machine.services
known_libs = get_shell.host_computer.File(LIB_STORE_PATH).get_files
for i in known_libs.indexes
known_libs[i] = known_libs[i].name
end for
s.set_exploits
if not fish_lib.hasIndex(s.info.split(" ")[0]) then continue
key = s.info.replace(".", "").replace(" ", "")
if known_libs.indexOf(key) then continue
so_name = fish_lib[s.info.split(" ")[0]]
sh = s.quick_root_shell(TABLEATTACK_SCRIPT)
if typeof(sh) != "shell" then continue
sh.scp("/lib/" + so_name, LIB_STORE_PATH, get_shell)
//sh.clear_logs(EMPTY_LOG_PATH)
get_shell.host_computer.File(LIB_STORE_PATH + "/" + so_name).rename(key)
end for
end while
end function
import_code("/home/me/h/libs/thor.src") //depends on Listlib, exports Thor
Thor.init(Command, "libfish")