//command scanlib if params.len != 0 then if params[0] == "-h" or params[0] == "--help" then exit("Error: scan [IP] [Port] [Memory Address] [Vuln Func]") end if metaxploit = null metaxploit = include_lib("/lib/metaxploit.so") if not metaxploit then metaxploit = include_lib(current_path+"/metaxploit.so") end if if not metaxploit then exit("Error: no metaxploit.so found!") end if computer_ = function(ovr) if typeof(ovr) != "computer" then return false while(true) print("----[Computer]----") print("please Select Number") print("[1] = Read File") print("[2] = Write File") print("[3] = Upload File") print("[4] = Download File") print("[5] = Change Password of User") print("[6] = Get list of users") print("[999] = Back") num = user_input("\n>") if num == "1" then filepath = user_input("File with path: ") file = ovr.File(filepath) if file == null then print("Error File not found!") continue end if print("File Content: ") print(file.get_content) else if num == "2" then filepath = user_input("File path (wihout the File itself): ") f = user_input("file with extension: ") file = ovr.File(filepath) if file == null then err = touch(filepath,f) if err != 1 then print(err) else file = ovr.File(filepath) if file == null then print("Error File could not be created.") else cont = user_input("content > ") e = file.set_content(cont) if e != 1 then print(e) else print("Content Successfully set!") end if end if end if end if else if num == "3" then // Upload else if num == "4" then // Donwload filepath = user_input("File path: ") file = ovr.File(filepath) a = filepath.split("/") fileloc = get_shell.host_computer.File(home_dir+"/Downloads/"+a[a.len-1] ) if fileloc == null then p = get_shell.host_computer.touch(home_dir+"/Downloads/",a[a.len-1]) if p != 1 then print(p) else if file == null then print("File Cannt be Found in "+filepath) else fileloc = get_shell.host_computer.File(home_dir+"/Downloads/"+a[a.len-1] ) o = fileloc.set_content(file.get_content) if o != 1 then print(o) else print("File Downloaded!") print("Path: "+home_dir+"/Downloads/"+a[a.len-1]) end if end if end if else if file == null then print("File Cannt be Found in "+filepath) else fileloc = get_shell.host_computer.File(home_dir+"/Downloads/"+a[a.len-1] ) o = fileloc.set_content(file.get_content) if o != 1 then print(o) else print("File Downloaded!") print("Path: "+home_dir+"/Downloads/"+a[a.len-1]) end if end if end if else if num == "5" then user = user_input("User: ") ok = ovr.change_password(user,"1234") if ok == 1 then print("Password for user "+ user +" was successfully changed to: 1234") else print("Error while Password change!") end if else if num == "6" then print("----[users]----") for f in ovr.File("/home").get_folders print(f.name) end for else if num == "999" then break end if end while end function shell_ = function(ovr) if typeof(ovr) != "shell" then return false while(true) print("----[Shell]----") print("please Select Number") print("[1] = Execute Remote Terminal with scan upload") print("[2] = Execute Remote Terminal without scan upload") print("[999] = Back") inp = user_input(">") if inp == "1" then user = user_input("please enter username: ") if user == "root" then if get_shell.host_computer.File("/lib/metaxploit.so") != null then get_shell.scp("/lib/metaxploit.so","/"+user+"/",ovr) else get_shell.scp(current_path+"/metaxploit.so","/"+user+"/",ovr) end if get_shell.scp(current_path+"/metaxploit.so","/"+user+"/",ovr) get_shell.scp(launch_path,"/"+user+"/",ovr) print(current_path+"/metaxploit.so") vulnerabfiles = get_shell.host_computer.File(current_path+"/vulnerabilities") if vulnerabfiles.is_folder then get_shell.scp(vulnerabfiles.path,"/"+user+"/",ovr) print(vulnerabfiles.path) end if else if get_shell.host_computer.File("/lib/metaxploit.so") != null then get_shell.scp("/lib/metaxploit.so","/home/"+user+"/",ovr) else get_shell.scp(current_path+"/metaxploit.so","/home/"+user+"/",ovr) end if get_shell.scp(current_path+"/metaxploit.so","/home/"+user+"/",ovr) get_shell.scp(current_path+"/scan","/home/"+user+"/",ovr) print(current_path+"/metaxploit.so") vulnerabfiles = get_shell.host_computer.File(current_path+"/vulnerabilities") if vulnerabfiles.is_folder then get_shell.scp(vulnerabfiles.path,"/home/"+user+"/",ovr) print(vulnerabfiles.path) end if end if ovr.start_terminal() else if inp == "2" then ovr.start_terminal() else if inp == "999" then break end if end while end function file_ = function(ovr) if typeof(ovr) != "file" then return false while(true) print("----[file]----") print(ovr.path) print("Owner: "+ ovr.owner + " Group: "+ ovr.group) print("Perms: "+ovr.permissions) print("please Select Number") print("[1] = Read") print("[2] = Write") print("[999] = Back") inp = user_input(">") if inp == "1" then print("Content: ") print(ovr.get_content) else if inp == "2" then cont = user_input("cont>") l = ovr.set_content(cont) if l != 1 then print(l) else print("Write ok!") end if else if inp == "999" then break end if end while end function folder_ = function(ovr) if typeof(ovr) != "file" then return false while(true) print("----[folder]----") print(ovr.path+"/") print("please Select Number") print("[1] = folders("+ovr.get_folders.len+")") print("[2] = files("+ovr.get_files.len+")") print("[999] = Back") inp = user_input(">") if inp == "1" then while(true) print("----[folders]----") print(ovr.path+"/") i=0 for f in ovr.get_folders print("["+i+"] = "+f.path) i = i + 1 end for print("[999] = Back") inp = user_input(">") if inp == "999" then break end if if ovr.get_folders.hasIndex(inp.to_int) then folder_(ovr.get_folders[inp.to_int]) end if end while else if inp == "2" then while(true) print("----[files]----") print(ovr.path+"/") i=0 for f in ovr.get_files print("["+i+"] = "+f.path) i = i + 1 end for print("[999] = Back") inp = user_input(">") if inp == "999" then break end if if ovr.get_files.hasIndex(inp.to_int) then file_(ovr.get_files[inp.to_int]) end if end while else if inp == "999" then break end if end while end function fileinit_ = function(ovr) if typeof(ovr) != "file" then return false if ovr.is_folder then folder_(ovr) else file_(ovr) end if end function handles_ = function(lib,shells,computers,routers,files,lanip) while(true) print("----[Main]----") print("No more Vulns found!") print("[1] = Shells ("+shells.len+")") print("[2] = Computers ("+computers.len+")") print("[3] = Routers ("+routers.len+")") print("[4] = Files ("+files.len+")") print("[999] = Back") inp = user_input(">") if inp == "1" then while(true) print("----[Shell]----") for s in shells print("["+s["key"]+"] = "+s["value"]) end for print("[999] = Back") s = user_input("select>") if shells.hasIndex(s.to_int) then ovr = lib.overflow(shells[s.to_int]["mem"],shells[s.to_int]["value"],lanip) shell_(ovr) else if s == "999" then break end if end while else if inp == "2" then while(true) print("----[Computer]----") for s in computers print("["+s["key"]+"] = "+s["value"]) end for print("[999] = Back") s = user_input("select>") if computers.hasIndex(s.to_int) then ovr = lib.overflow(computers[s.to_int]["mem"],computers[s.to_int]["value"],lanip) computer_(ovr) else if s == "999" then break end if end while else if inp == "3" then else if inp == "4" then while(true) print("----[Files]----") for s in files print("["+s["key"]+"] = "+s["value"]) end for print("[999] = Back") s = user_input("select>") if files.hasIndex(s.to_int) then ovr = lib.overflow(files[s.to_int]["mem"],files[s.to_int]["value"],lanip) fileinit_(ovr) else if s == "999" then break end if end while else if inp == "999" then break end if end while end function run = true i = 0 IP = null if params.len != 0 then IP = params[0] libscanned = {} scanfunc_ = function(lib,loadvuln,lanip) if loadvuln then vulnerabfile = get_shell.host_computer.File(current_path+"/vulnerabilities/"+lib.lib_name()) listMem = [] memread = vulnerabfile.get_content().remove("[").remove("]").split(", ") for memreadindex in memread.indexes listMem.push("") for memstringindex in memread[memreadindex].indexes if memstringindex > 0 and memstringindex < (memread[memreadindex].len() -1) then listMem[memreadindex] = listMem[memreadindex]+memread[memreadindex][memstringindex] end for end for else listMem = metaxploit.scan(lib) vulnerabfile = get_shell.host_computer.File(current_path+"/vulnerabilities/"+lib.lib_name()) if vulnerabfile == null then get_shell.host_computer.touch(current_path+"/vulnerabilities/",lib.lib_name()) vulnerabfile = get_shell.host_computer.File(current_path+"/vulnerabilities/"+lib.lib_name()) get_shell.host_computer.File(current_path+"/vulnerabilities").chmod("o+wrx",true) if vulnerabfile != null then vulnerabfile.set_content(listMem) end if index = 1 for itemMem in listMem print(index +": [" + itemMem + "]") index = index + 1 end for if listMem.len == 0 then exit("Scan completed: No issues detected.") shells = {} computers = {} routers = {} files = {} print("Scan completed: detected issues in " + listMem.len + " memory zones.") for itemMem in listMem print("Scanning for vulnerabilities at memory zone: " + itemMem) vuln = metaxploit.scan_address(lib, itemMem) lel = {} word = false wordi = 0 for i in vuln if i == "<" then word = true if not lel.hasIndex(wordi) then lel[wordi] = "" lel[wordi] = lel[wordi] + i else if lel.hasIndex(wordi) and lel[wordi].lastIndexOf("</b>") != -1 then wordi = wordi + 1 word = false else if lel.hasIndex(wordi) and word then lel[wordi] = lel[wordi] + i end if end for newlel = {} for k in lel val = k["value"] if val.indexOf(".so") == null and val.indexOf(".") == null then newlel[newlel.len] = val.replace("<b>","").replace("</b>","") end if end for for l in newlel print("Address: "+ itemMem) print("Vuln Func: "+ l["value"]) if lanip then ovr = lib.overflow(itemMem,l["value"],lanip) else ovr = lib.overflow(itemMem,l["value"],"1234") end if if typeof(ovr) == "shell" then shells[shells.len+1] = {"mem":itemMem,"value": l["value"]} else if typeof(ovr) == "computer" then computers[computers.len+1] = {"mem":itemMem,"value": l["value"]} else if typeof(ovr) == "file" then files[files.len+1] = {"mem":itemMem,"value": l["value"]} end if end for end for handles_(lib,shells,computers,routers,files,lanip) end function scanport_ = function(port) i = port lanip = "" if i == 0 then lanip = user_input("LAN IP of victim: ") net_session = metaxploit.net_use(IP,port) if net_session == null then exit("Error: net_session") lib = net_session.dump_lib() if get_shell.host_computer.File(current_path+"/vulnerabilities/"+lib.lib_name()) != null then while(true) print("Found exist vulnerabilities list") print("[1] = Use exist vulnerabilities list") print("[2] = Perform new scan") print("[999] = Back") inp = user_input(">") if inp == "1" then print("----PERFORMIMING ATTACK TO MEMORIZED VULNERABILITIES FOR: "+lib.lib_name()+"-----") scanfunc_(lib,true,lanip) else if inp == "2" then print("----SCANNING PORT: "+i+"-----") print("Scanning memory address...") scanfunc_(lib,false,lanip) else if inp == "999" then break end if end while else print("----SCANNING PORT: "+i+"-----") print("Scanning memory address...") scanfunc_(lib,false,lanip) end if end function handlescannes_ = function() while(true) print("----Scanned----") print("Select One Port/Lib") for k in libscanned print("["+k["key"]+"] = ("+k["value"]+")") end for print("[999] = Exit") inp = user_input(">") if libscanned.hasIndex(inp.to_int) then scanport_(inp.to_int) else if inp == "999" then break end if end while end function scanlib_ = function(f) lib = metaxploit.load(f.path) if not lib then exit("can't find library !") print("Found Lib: "+lib.lib_name()) if get_shell.host_computer.File(current_path+"/vulnerabilities/"+lib.lib_name()) != null then while(true) print("Found exist vulnerabilities list") print("[1] = Use exist vulnerabilities list") print("[2] = Perform new scan") print("[999] = Back") inp = user_input(">") if inp == "1" then print("----PERFORMIMING ATTACK TO MEMORIZED VULNERABILITIES FOR: "+lib.lib_name()+"-----") scanfunc_(lib,true,"") else if inp == "2" then print("Scanning memory address...") scanfunc_(lib,false,"") else if inp == "999" then break end if end while else print("Scanning memory address...") scanfunc_(lib,false,"") end if end function handlescanneslocal_ = function() while(true) print("----Scanned----") print("Select One Lib") i = 0 for k in get_shell.host_computer.File("/lib").get_files print("["+i+"] = ("+k.path+")") i = i +1 end for print("[999] = Exit") inp = user_input(">") if get_shell.host_computer.File("/lib").get_files.hasIndex(inp.to_int) then scanlib_(get_shell.host_computer.File("/lib").get_files[inp.to_int]) else if inp == "999" then break end if end while end function if params.len == 2 then port = params[1] lanip = "" if port == "0" then lanip = user_input("LAN IP of victim: ") print("----SCANNING PORT: "+port+"-----") net_session = metaxploit.net_use(IP,port.val) if net_session == null then exit("Error: net_session") lib = net_session.dump_lib() if not lib then exit("can't find library !") print("Found Lib: "+lib.lib_name()) if get_shell.host_computer.File(current_path+"/vulnerabilities/"+lib.lib_name()) != null then while(true) print("Found exist vulnerabilities list") print("[1] = Use exist vulnerabilities list") print("[2] = Perform new scan") print("[999] = Back") inp = user_input(">") if inp == "1" then print("----PERFORMIMING ATTACK TO MEMORIZED VULNERABILITIES FOR: "+lib.lib_name()+"-----") scanfunc_(lib,true,lanip) else if inp == "2" then print("Scanning memory address...") scanfunc_(lib,false,lanip) else if inp == "999" then break end if end while else print("Scanning memory address...") scanfunc_(lib,false,lanip) end if else if params.len == 4 then port = params[1] lanip = "" if port == "0" then lanip = user_input("LAN IP of victim: ") print("----PORT: "+port+"-----") net_session = metaxploit.net_use(IP,port.val) if net_session == null then exit("Error: net_session") lib = net_session.dump_lib() if not lib then exit("can't find library !") print("Found Lib: "+lib.lib_name()) print("----Executing Overflow with infos") if lanip then ovr = lib.overflow(params[2],params[3],lanip) else ovr = lib.overflow(params[2],params[3],"1234") end if if typeof(ovr) == "shell" then shell_(ovr) else if typeof(ovr) == "computer" then computer_(ovr) else if typeof(ovr) == "file" then fileinit_(ovr) end if else if params.len == 1 then ipAddress = params[0] isLanIp = is_lan_ip( ipAddress ) if isLanIp then router = get_router; else router = get_router( ipAddress ) end if if router == null then exit("nmap: ip address not found") ports = null if not isLanIp then ports = router.used_ports else ports = router.device_ports(ipAddress) end if if ports == null then exit("nmap: ip address not found") if typeof(ports) == "string" then exit(ports) print("Interesting ports on " + params[0] + "\n") if(ports.len == 0) then exit("Scan finished. No open ports.") for k in ports i = k.port_number port = i net_session = metaxploit.net_use(IP,port) if net_session == null then continue lib = net_session.dump_lib() if not lib then exit("can't find library !") if libscanned.hasIndex(lib.lib_name()) then continue end if libscanned[i] = lib.lib_name() end for // Router net_session = metaxploit.net_use(IP) if net_session == null then handlescannes_() lib = net_session.dump_lib() if not lib then exit("can't find library !") libscanned[0] = lib.lib_name() handlescannes_() else handlescanneslocal_() end if