bitsploit

print("<b>Bitsploit</b> v2.0.2 by Bitwise team")
print("Top secret. <b>Only for Bitwise team.</b>")

print("On current system must be <b>metaxploit.so</b>, <b>crypto.so</b>, and <b>decipher</b> programme (optional <b>nmap</b>)")

host = get_shell().host_computer
currentPath = host.current_path
Metaxploit = include_lib("/lib/metaxploit.so")
if not Metaxploit then
    Metaxploit = include_lib(currentPath + "/metaxploit.so")
end if
Crypto = include_lib("/lib/crypto.so")
if not Crypto then
    Crypto = include_lib(currentPath + "/crypto.so")
end if

if params.len < 1 or params[0] == "-h" or params[0] == "--help" then exit("<b>Usage: bitsploit [victim's ip/domain] (victim's port)</b>")

if is_valid_ip(params[0]) == false then
    params[0] = nslookup(params[0])
    if is_valid_ip(params[0]) == false then exit("<b>Invalid ip address!</b>")
end if

lanIP = ""
if is_lan_ip(params[0]) == false then
    if host.File("/bin/nmap") != null then
        get_shell().launch("/bin/nmap", params[0])
    else if host.File(currentPath + "/nmap") != null then
        get_shell().launch(currentPath + "/nmap", params[0])
    end if
    lanIP = user_input("Please, type victim's LAN IP (optional): ")
else
    lanIP = params[0]
end if

killer = null
passwd = ""

while killer == null
    ans = user_input("Do you want to turn on agressive mode? y/n: ").lower()

    if ans == "y" or ans == "yes" then
        killer = true
        print("Program will be trying to open shell on non ssh (22) ports and change users's passwords")

        passwd = user_input("Type a new password if you want to use nuke exploiting: ")
    else if ans == "n" or ans == "no" then
        killer = false
        print("Program will be trying to exploit only ssh (22) port if no port is specifyed")
    end if
end while

libs = []

if params.len > 1 then
    libs = Metaxploit.net_use(params[0], params[1].to_int).dump_libs()
    if typeof(libs) != "list" then
        libs = [libs]
    end if
else if killer == false then
    params.push("22")
    libs = Metaxploit.net_use(params[0], params[1].to_int).dump_libs()
    if typeof(libs) != "list" then
        libs = [libs]
    end if
else
    if is_lan_ip(params[0]) then exit("<b>Please, specify port for lan ip's</b>")

    libs = Metaxploit.net_use(params[0]).dump_libs()
    if typeof(libs) != "list" then
        libs = [libs]
    end if

    ports = get_router(params[0]).used_ports
    if typeof(ports) != "list" then
        ports = [ports]
    end if

    for port in ports
        netconn = Metaxploit.net_use(params[0], port.port_number)
        if netconn == null then continue

        sublibs = netconn.dump_libs()
        if typeof(sublibs) != "list" then
            sublibs = [sublibs]
        end if

        for sublib in sublibs
            libs.push(sublib)
        end for
    end for
end if

print("Vzlom zhopi...")

shells = []
files = []
comps = []

rootpasses = []

decpass = function(data)
    print("Doing a try to decipher a password")

    index = data.indexOf("root:")
    rootpasses.push(Crypto.decipher("root", data[index+5:index+5+32]))
end function

gotpass = false

for lib in libs
    addrs = Metaxploit.scan(lib)

    for addr in addrs
        info = Metaxploit.scan_address(lib, addr)

        info = info.remove("decompiling source...").remove("searching unsecure values...")
        info = info[2:]
        while info.indexOf("Unsafe check: ") != null or info.indexOf("<b>") != null or info.indexOf("</b>") != null
            info = info.remove("Unsafe check: ").remove("<b>").remove("</b>")
        end while
        while info.indexOf("loop in array ") != null
            info = info.replace("loop in array ", "<tag>")
        end while
        while info.indexOf("string copy in ") != null
            info = info.replace("string copy in ", "<tag>")
        end while

        result = null
        while info.indexOf("<tag>") != null
            a = info.indexOf("<tag>") + 5

            info = info.remove(info[:a])

            str = info[:info.indexOf(".")]
            print("Eploiting "+lib.lib_name+" "+lib.version+" "+addr+" "+str+"...")

            result = null
            if lib.lib_name == "kernel_router.so" then
                result = lib.overflow(addr, str, lanIP)
            else if passwd != "" then
                result = lib.overflow(addr, str, passwd)
            else
                result = lib.overflow(addr, str)
            end if

            if result != null then
                type = typeof(result)

                print("----- Got result: "+result+" -----")

                if type == "shell" then
                    print("Found shell!")
                    shells.push(result)

                    if gotpass == false then
                        file = result.host_computer.File("/etc/passwd")
                        if file != null then
                            data = file.content
                            if data != null then
                                decpass(data)
                                gotpass = true
                            end if
                        end if
                    end if
                else if gotpass == true then
                    //nothing
                else if type == "file" then
                    print("Found files! Name: "+result.name+"...")
                    files.push(result)

                    data = null

                    if result.is_folder == true then
                        if result.name == "etc" then
                            files = result.get_files
                            for file in files
                                if file.name == "passwd" then
                                    data = file.content
                                    break
                                end if
                            end for
                        end if
                    else if result.name == "passwd" then
                        data = result.content
                    end if

                    if data != null then
                        decpass(data)
                        gotpass = true
                    end if
                else if type == "computer" then
                    print("Got computer access!")
                    comps.push(result)

                    file = result.File("/etc/passwd")
                    if file != null then
                        data = file.content
                        if data != null then
                            decpass(data)
                            gotpass = true
                        end if
                    end if
                else if type == "number" then
                    if result == 1 then
                        print("Try to login to above account with the password <b>"+passwd+"</b>. Remeber this password.")
                        user_input("Press <b>enter</b> to continue...")
                    end if
                end if
            end if
        end while
    end for
end for

print("----- Exploiting ended -----")
if rootpasses.len != 0 then
    print("Found some root passwords:")
    for rootpass in rootpasses
        print(" "+rootpass)
    end for
    print("")
    print("Type <b>sudo -s</b> when you connect to shell and enter one of them.")
    print("")
end if
print("Found "+shells.len+" shells")

i = 0
for shell in shells
    i = i + 1
    print("--- Shell ["+i+"] ---")

    comp = shell.host_computer

    print("Lan ip: "+comp.lan_ip)
    portsRaw = comp.get_ports
    ports = []
    for port in portsRaw
        ports.push(port.port_number)
    end for
    print("Ports: "+ports.join(", "))
    print("Processes:")
    print(comp.show_procs)
end for

if shells.len != 0 then
    id = user_input("Please, type a shell number:")

    shells[id.to_int - 1].start_terminal()
end if