// Command mapscan
script_version = 2.4
// Changes:
// - Added support for separate library/version logging
// - Removed system.log text logic and replaced with Log Viewer logic
// - Added --interactive mode for password privilege level processing
// - Added first pass of color formatting to terminal output
// Version 2.0
// - Added password variable for vulnerability testing
// - Added logic to capture and display new objects returned by exploit testing
// - Added logic to determine the privilege level of shell objects returned by exploit testing
// - Added logic to show and delete system.log using highest level shell access (DEPRECATED)
if params.len < 1 or params.len > 2 or params[0] == "-h" or params[0] == "--help" then exit("Usage: "+program_path.split("/")[-1]+" [ip_address] [optional --interactive]")
// Get metax library
metax = include_lib("/lib/metaxploit.so")
if not metax then exit("Error: Unable to find 'metaxploit.so'. Put missing library in the 'lib' folder.")
// Function to strip all HTML tags from a given string
stripHtml = function(inputString)
if not inputString then return ""
result = ""
inTag = false
// Loop through each character in the string
for i in range(0, inputString.len - 1)
char = inputString[i]
if char == "<" then
inTag = true
continue
else if char == ">" then
inTag = false
continue
end if
// Append character only if it's outside of a tag
if not inTag then
result = result + char
end if
end for
return result
end function
// Global (local) variables
shell = get_shell
computer = shell.host_computer
password = "password"
// Optional interactive mode - Allows user to provide password privilege levels from terminal output
interactive_mode = 0
if params.len == 2 then
if params[1] == "--interactive" then interactive_mode = 1
end if
if not is_valid_ip(params[0]) then exit("MapScan: invalid ip address")
if not computer.is_network_active then exit("MapScan: No internet access.")
ipAddress = params[0]
if ipAddress == "127.0.0.1" then ipAddress = computer.local_ip
isLanIp = is_lan_ip( ipAddress )
if isLanIp then
router = get_router;
else
router = get_router( ipAddress )
end if
if router == null then exit("MapScan: ip address not found")
ports = null
if not isLanIp then
ports = router.used_ports
else
ports = router.device_ports(ipAddress)
end if
if ports == null then exit("MapScan: ip address not found")
if typeof(ports) == "string" then exit(ports)
mapscanFolderPath = "/home/"+active_user
targetsFolderName = "Targets"
targetsFolder = mapscanFolderPath + "/" + targetsFolderName
if computer.File(targetsFolder) == null then computer.create_folder(mapscanFolderPath, targetsFolderName)
explibFolderName = "ExpLib"
explibFolder = mapscanFolderPath + "/" + explibFolderName
if computer.File(explibFolder) == null then computer.create_folder(mapscanFolderPath, explibFolderName)
tgtFile = computer.File(targetsFolder + "/" + ipAddress + ".txt")
if tgtFile == null then
computer.touch(targetsFolder, ipAddress + ".txt")
tgtFile = computer.File(targetsFolder + "/" + ipAddress + ".txt")
end if
output = ""
info = "PORT STATE SERVICE VERSION LAN"
info_length = info.len
clear_screen
line1 = "[+] MapScan v"+script_version+" - Advanced Network Exploitation Engine"
line2 = "[+] Target: " + params[0]
line3 = "[+] Time: "+ current_date + ""
line4 = "[+] PHASE 1: SERVICE ANALYSIS"
print(line1)
output = output + line1 + char(10)
print(line2)
output = output + line2 + char(10)
print(line3)
output = output + line3 + char(10)
print(line4)
output = output + line4 + char(10)
if(ports.len == 0) then exit("Scan finished. No open ports.")
for port in ports
service_info = router.port_info(port)
lan_ips = port.get_lan_ip
port_status = "open"
if(port.is_closed and not isLanIp) then
port_status = "closed"
end if
new_entry = port.port_number + " " + port_status + " " + service_info + " " + lan_ips
if info_length < new_entry.len then info_length = new_entry.len
info = info + "\n" + new_entry
end for
dashes = ""
for c in range(1, info_length+8)
dashes = dashes + "-"
end for
dashes = dashes + ""
print(dashes)
print(format_columns(info))
print(dashes)
output = stripHtml(output + char(10) + dashes + char(10) + format_columns(info) + char(10) + dashes + char(10))
tgtFile.set_content(output)
// New variables for tracking new result objects and SQL library scans and capturing root shell access
new_types = []
sql_scanned = false
cuZone = null
cuExploit = null
cuPort = null
cuType = null
line5 = "[+] PHASE 2: VULNERABILITY MAPPING & TESTING"
print(dashes + char(10) + line5)
output = ""
for port in ports
net_session = metax.net_use(ipAddress, port.port_number)
if not net_session then exit("Error: Unable to connect to port "+port.port_number+"")
metaLib = net_session.dump_lib
expFilename = metaLib.lib_name + "-v" + metaLib.version + ".txt"
expFile = computer.File(explibFolder + "/" + expFilename)
if expFile == null then
computer.touch(explibFolder, expFilename)
expFile = computer.File(targetsFolder + "/" + ipAddress + ".txt")
print("\nScanning " + metaLib.lib_name + " v" + metaLib.version + " on port " + port.port_number)
expFile = computer.File(explibFolder + "/" + metaLib.lib_name + "-v" + metaLib.version + ".txt")
output = metaLib.lib_name + " v" + metaLib.version
scanResult = metax.scan(metaLib)
for zone in scanResult
memory_scan = metax.scan_address(metaLib, zone)
print("\nFound memory zone: " + zone)
output = output + char(10) + char(10) + "Exploits for zone: " + zone
xpList = memory_scan.split("Unsafe check: ")[1:]
exploits = []
for xp in xpList
labelStart = xp.indexOf("")
labelEnd = xp.indexOf("")
exploit = xp[labelStart + 3: labelEnd]
print("\nTesting: " + exploit)
wait(1)
// Added password parameter for number type results
result = metaLib.overflow(zone, exploit, password)
if result == null then
status = "Undefined / Conditional"
else if typeof(result) == "shell" then
status = "Shell (?)"
target_comp = result.host_computer
shell_user = "guest" // Default
// Create a file in /var (accessible by all accounts)
target_comp.touch("/var", "tmp.txt")
temp_file = target_comp.File("/var/tmp.txt")
if temp_file != null then
shell_user = temp_file.owner // The owner of a newly touched file is the active shell user
temp_file.delete // More deletions to cleanup later
end if
if shell_user == "root" then
status = "Shell (ROOT)"
// Flag the root exploit details if we don't have a root yet
if cuType == null or cuType != "Root" then
cuZone = zone
cuExploit = exploit
cuPort = port.port_number
cuType = "Root"
print("Saved as final cleanup vector.")
end if
else
status = "Shell ("+shell_user+")"
if cuType == null then
cuZone = zone
cuExploit = exploit
cuPort = port.port_number
cuType = shell_user
print("Saved as possible cleanup vector.")
else if cuType == "guest" and shell_user != "guest" then
cuZone = zone
cuExploit = exploit
cuPort = port.port_number
cuType = shell_user
print("Saved as possible cleanup vector.")
end if
end if
else if typeof(result) == "file" then
status = "File"
else if typeof(result) == "number" then
status = ""
if interactive_mode == 1 then
print("Privelege level?")
paused = 5
pwdLevel = ""
while paused and pwdLevel != "r" and pwdLevel != "u" and pwdLevel != "g"
pwdLevel = user_input("[R]oot, [U]ser or [G]uest: ")
wait(1)
paused = paused - 1
end while
if pwdLevel == "r" then
status = "Privilege: Root" + char(10)
else if pwdLevel == "u" then
username = user_input("Username? ")
status = "User: " + username + char(10)
else if pwdLevel == "g" then
status = "Privilege: Guest" + char(10)
end if
end if
status = status + "Password: '"+password+"'"
else if typeof(result) == "computer" then
status = "Computer"
else
status ="New type found: " + typeof(result)
if new_types.indexOf(typeOf(result)) == null then new_types.push(typeOf(result))
end if
exploits.push(exploit + " (" + status + ")")
wait(0.5)
end for
print("\nMemory zone: " + zone + "\nAvailable vulnerabilities:\n" + exploits.join("\n"))
output = output + char(10) + exploits.join(char(10))
if new_types.len > 0 then
print("\nNew vulnerability types found:\n" + new_types.join("\n"))
output = output + char(10) + char(10) + "New Vulnerability Types:" + char(10) + new_types.join(char(10))
end if
if metaLib.lib_name.indexOf("sql") then sql_scanned = true
end for
expFile.set_content(output)
else
print(expFilename + " found in Exploit library.")
end if
print(dashes)
end for
print ("\nMapScan completed.\nResults saved to " + ipAddress + ".txt in " + targetsFolderName + " folder.")
line6 = "[+] PHASE 3: SYSTEM LOG CLEANUP"
print(dashes + char(10) + line6)
// --- V2: Clear Our Tracks ---
if cuExploit != null then
print("\n[+] Cleaning tracks ..................")
// Re-trigger the saved root vulnerability
cleanup_session = metax.net_use(ipAddress, cuPort)
if cleanup_session then
cleanup_lib = cleanup_session.dump_lib
tgt_shell = cleanup_lib.overflow(cuZone, cuExploit)
if typeof(tgt_shell) == "shell" then
tgt_comp = tgt_shell.host_computer
log_file = tgt_comp.File("/var/system.log")
if log_file != null then
// Show the log before deletion
print("\n[+] Sending target system log to Log Viewer.")
tgt_shell.launch("/usr/bin/LogViewer.exe", "/var/system.log")
wait(6)
// Deletion / Fresh log
log_file.delete
tgt_comp.touch("/var", "system.log")
print("\n[+] Processing deletion... Replacing with blank structure...")
wait(2)
// Show the fresh log
print("\n[+] Sending refreshed system log to Log Viewer.")
tgt_shell.launch("/usr/bin/LogViewer.exe", "/var/system.log")
wait(6)
else
print("Error: /var/system.log missing or inaccessible.")
end if
print(dashes)
// Let's talk aboug "start_terminal" and bash ...
tgt_shell.launch("/bin/bash")
end if
end if
else
print(dashes)
print("\n[WARNING] Scan complete, but no root exploit was found. Logs could not be cleared automatically.")
end if
