unix-ninja / hackersandbox

The Hacker's Sandbox

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

addUsers creates user on last vm created, not current vm.

Grandomthoughts opened this issue · comments

The addUsers code doesn't track the current vm, any users created after the VM initialization process end up being created on the last vm initialized. Here is a quick mis pack for testing.

-- load test VM
newVM ("test")
setProperty( { ip = "1.1.1.1" })
addFile ({ name = "/bin/addu", content = garbage(10), exec="addu", acl="777"})
addUser ( "root", "toor" )

-- load test2 VM
newVM("test2")
setProperty ({ ip = "1.1.1.2" })
addService ({ port = "23", name = "telnetd", exec = "", start="true", poll="Login:" })
addUser ( "root", "go" )

function addu()
addUser ( "newguy", "password" )
end

function intro()
login ({ host = "test", user = "root"})
end

Running addu on test results i newguy on test2.
Super close to working I think, thanks!

Hmm, that's actually an interesting point. Technically that's working as intended (it's adding users to the latest VM in the vPC store) but it would def be super useful to add users to arbitrary machines.

I think the answer here might be to overload the addUser() function so that it takes an associative array of parameters, much like the login() function does, and then we can just specify a target host when we want one.

Let me think about this a little bit, because there are a couple of different ways this could be approached. I should have a patch for this in a couple of days.

Ok, this should be live now. addUser() is now an overloaded function. Calling it the way you have been (with two string arguments) will behave as it has before for backwards compatibility.

However, you can now pass a single table as the argument, which can be given the following keys: host, user, password.

For example, your function can now look like this:

function addu()
addUser ({ host="test", user="newguy", password="password" })
end

Alternatively, you can do something like this to make it add to whatever VM you are running the command from:

function addu()
addUser ({ host=hostname(), user="newguy", password="password" })
end

Let me know how that works out.

This is great, compiled on Ubuntu. I've got a bunch of ideas on how to use this. Exploits on remote services to force create users for one... One thing I noticed is the overloaded version must be skipping or missing the code to create the user's home directory. Users created on initialization get them, but not using the new functions.

Ah, it looks like addDir() was suffering from the same deal. Technically, it was creating the folders on whatever the last VM in the store was. I have just pushed a new patch to correct this. Hopefully that helps.