Mapscan v2.0 - Archeagus Grey Hack Series, Episode 5

// Command mapscan v2.0 (RC)
if params.len != 1 or params[0] == "-h" or params[0] == "--help" then exit("Usage: "+program_path.split("/")[-1]+" [ip_address]")

metax = include_lib("/lib/metaxploit.so")
if not metax then exit("Error: Unable to find 'metaxploit.so'. Put missing library in the 'lib' folder.")

// Adding password variable for vulnerability testing
shell = get_shell
computer = shell.host_computer
password = "password"

if not is_valid_ip(params[0]) then exit("nmap: invalid ip address")
if not computer.is_network_active then exit("nmap: No internet access.")

ipAddress = params[0]
if ipAddress == "127.0.0.1" then ipAddress = computer.local_ip
isLanIp = is_lan_ip( ipAddress )

if isLanIp then
   router = get_router;
else
   router = get_router( ipAddress )
end if

if router == null then exit("nmap: ip address not found")

ports = null

if not isLanIp then
   ports = router.used_ports
else
   ports = router.device_ports(ipAddress)
end if

if ports == null then exit("nmap: ip address not found")
if typeof(ports) == "string" then exit(ports)

targetsFolderName = "Targets"
targetsFolderPath = "/home/"+active_user
targetsFolder = targetsFolderPath + "/" + targetsFolderName
if computer.File(targetsFolder) == null then computer.create_folder(targetsFolderPath, targetsFolderName)

outputFile = computer.File(targetsFolder + "/" + ipAddress + ".txt")

if outputFile == null then
    computer.touch(targetsFolder, ipAddress + ".txt")
    outputFile = computer.File(targetsFolder + "/" + ipAddress + ".txt")
end if

output = ""

info = "PORT STATE SERVICE VERSION LAN"
clear_screen
print("Starting nmap v2.0 at " + current_date)
print("Interesting ports on " + params[0] + "\n")
if(ports.len == 0) then exit("Scan finished. No open ports.")

for port in ports
   service_info = router.port_info(port)
   lan_ips = port.get_lan_ip
   port_status = "open"

   if(port.is_closed and not isLanIp) then
      port_status = "closed"
   end if
   info = info + "\n" + port.port_number + " " + port_status + " " + service_info + " " + lan_ips
end for
print(format_columns(info) + "\n")
output = output + format_columns(info) + char(10)

// New variables for tracking new result objects and SQL library scans and capturing root shell access
new_types = []
sql_scanned = false
cuZone = null
cuExploit = null
cuPort = null
cuType = null

for port in ports
   net_session = metax.net_use(ipAddress, port.port_number)
   if not net_session then exit("Error: Unable to connect.")

   metaLib = net_session.dump_lib
   if not metaLib.lib_name.indexOf("sql") or not sql_scanned then
      print("\nScanning " + metaLib.lib_name + " v" + metaLib.version + " on port " + port.port_number)
      output = output + char(10) + char(10) + metaLib.lib_name + " v" + metaLib.version + " on port " + port.port_number
      scanResult = metax.scan(metaLib)

      for zone in scanResult
         memory_scan = metax.scan_address(metaLib, zone)
         print("\nFound memory zone: " + zone)
         output = output + char(10) + char(10) + "Exploits for zone: " + zone
         xpList = memory_scan.split("Unsafe check: ")[1:]
         exploits = []
         for xp in xpList
            labelStart = xp.indexOf("<b>")
            labelEnd = xp.indexOf("</b>")
            exploit = xp[labelStart + 3: labelEnd]
         print("\nTesting: " + exploit)
         wait(1)
            // Added password parameter for number type results
            result = metaLib.overflow(zone, exploit, password)
            if result == null then
               status = "Undefined / Conditional"
            else if typeof(result) == "shell" then
               status = "Shell (?)"

               target_comp = result.host_computer
               shell_user = "guest" // Default
                  // Create a file in /var (accessible by all accounts)
                  target_comp.touch("/var", "tmp.txt")
                  temp_file = target_comp.File("/var/tmp.txt")

                  if temp_file != null then
                     shell_user = temp_file.owner // The owner of a newly touched file is the active shell user
                     temp_file.delete // More deletions to cleanup later
                  end if

               if shell_user == "root" then
                    status = "Shell (ROOT)"

                  // Flag the root exploit details if we don't have a root yet
                  if cuType == null or cuType != "Root" then
                     cuZone = zone
                     cuExploit = exploit
                     cuPort = port.port_number
                     cuType = "Root"
                     print("Saved as final cleanup vector.")
                  end if
               else

                  status = "Shell ("+shell_user+")"
                  if cuType == null then
                     cuZone = zone
                     cuExploit = exploit
                     cuPort = port.port_number
                     cuType = shell_user
                     print("Saved as possible cleanup vector.")
                  else if cuType == "guest" and shell_user != "guest" then
                     cuZone = zone
                     cuExploit = exploit
                     cuPort = port.port_number
                     cuType = shell_user
                     print("Saved as possible cleanup vector.")
                  end if
               end if
            else if typeof(result) == "file" then
               status = "File"
            else if typeof(result) == "number" then
               status = "Password: '"+password+"'"
            else if typeof(result) == "computer" then
               status = "Computer"
            else
               status ="New type found: " + typeof(result)
               if new_types.indexOf(typeOf(result)) == null then new_types.push(typeOf(result))
            end if
            exploits.push(exploit + " (" + status + ")")
         wait(0.5)
         end for
         print("\nMemory zone: " + zone + "\nAvailable vulnerabilities:\n" + exploits.join("\n"))
         output = output + char(10) + exploits.join(char(10))
         if new_types.len > 0 then
            print("\nNew vulnerability types found:\n" + new_types.join("\n"))
            output = output + char(10) + char(10) + "New Vulnerability Types:" + char(10) + new_types.join(char(10))
         end if
         if metaLib.lib_name.indexOf("sql") then sql_scanned = true
      end for
   end if
end for
outputFile.set_content(output)
print ("\nNMAP Scan completed.\nResults saved to " + ipAddress + ".txt in " + targetsFolderName + " folder.")

// --- V2: Clear Our Tracks ---
if cuExploit != null then
    print("\nCleaning tracks")

    // Re-trigger the saved root vulnerability
    cleanup_session = metax.net_use(ipAddress, cuPort)
    if cleanup_session then
        cleanup_lib = cleanup_session.dump_lib
        root_shell = cleanup_lib.overflow(cuZone, cuExploit)

        if typeof(root_shell) == "shell" then
            tgt_comp = root_shell.host_computer
            log_file = tgt_comp.File("/var/system.log")

            //if log_file != null then
                // Show the log before deletion
                // print("\nTarget system log before deletion:")
                // print("--------------------------------------------------")
                // log_content = log_file.get_content
                // if log_content == "" or log_content == null then
                //     print("[Log is currently empty]")
                //else
                //    print(log_content)
                //end if
                //print("--------------------------------------------------")

                //wait(3)

                // Deletion / Fresh log
                log_file.delete
                tgt_comp.touch("/var", "system.log")
                print("\nProcessing deletion... Replacing with blank structure...")
                wait(1)

                // Show the fresh log
                //fresh_log_file = tgt_comp.File("/var/system.log")
                //print("\nTarget system log after deletion:")
                //print("--------------------------------------------------")
                //if fresh_log_file != null then
                    //new_content = fresh_log_file.get_content
                    //if new_content == "" or new_content == null then
                   //     print("<color=green>[SUCCESS] Log is completely blank. Tracks cleared!</color>")
                   // else
                   //     print(new_content)
                    //end if
                //else
                    //print("<color=red>[ERROR] Failed to verify replacement log file.</color>")
                //end if
                //print("--------------------------------------------------")

            //else
            //    print("<color=red>Error: /var/system.log missing or inaccessible.</color>")
            //end if

            // Let's talk aboug "start_terminal" and bash ...
            root_shell.launch("/bin/bash")
        end if
    end if
else
    print("\n[WARNING] Scan complete, but no root exploit was found. Logs could not be cleared automatically.")
end if