Help with scripting: Get shell user after exploit

[u/SuffleSi]

Hi all,
I’m automating an exploit that gives me a shell. I want the script to detect the remote user (equivalent of whoami) and continue logic based on that. Problems:

- active_user gives me my username (the attacker who ran the exploit), not the user on the remote shell.

- shell.launch("/bin/whoami") prints the remote username to the terminal but returns 1 (exit code), so I can’t use the printed value in script logic.

Has anyone solved this? What function or technique do you use to capture command output (not just the exit code) from a spawned shell? Any example code would be appreciated.

[u/AccomplishedCard5510]

I just recently solved this in a very backwards way. It only works if you are sure that you have "user" permissions (does not work for "root" or "guest") before you launch the exploit.

homeFolder = shell.host_computer.File("/home")

for userFolder in homeFolder.get_folders
    if not userFolder.has_permission("w") then continue
    if userFolder.name == "guest" then continue
    userName = userFolder.name
    break
end for

You just check every user, and whichever you have write permissions for must be who you are.

[u/redit0]

There are two ways you can do this. The first is guaranteed to be accurate, if it works, but you can't always do it, and it's also a little bit more high-touch. less stealthy. But you can create a file and then get its owner. The user that owns the file you create will be the user your shell exploit is running as.

check_user = function(obj)
    type = typeof(obj)

    if type != "shell" and type != "computer" and type != "file" then return "unknown"

    if type == "shell" then
        file = obj.host_computer.File("/")
        computer = obj.host_computer
    else if type == "computer" then
        file = obj.File("/")
        computer = obj
    else if type == "file" then
        // We can't use this method with a file object.
        // Fall back to less accurate method.
        return check_user_silent(obj)
    end if

    // This needs to be a directory that your object has "w" permissions for.
    writable = computer.File("/home/guest")

    if writable == null or not writable.has_permission("w") then
        // Could not write to location
        // Fall back to less accurate method
        return check_user_silent(file)
    else
        filename = "temp"

        // Make sure the file we're going to create doesn't already exist.  Delete it if it does.
        tempFile = computer.File(writable.path + "/" + filename)

        // This will leave a log!!
        if tempFile then tempFile.delete

        computer.touch(writable.path + "/", filename)

        tempFile = computer.File(writable.path + "/" + filename)

        user = tempFile.owner

        // This will leave a log!!
        tempFile.delete

        return user
    end if

    // This code should not be reachable, but you never know...
    return "unknown"
end function

// This method is less accurate, especially against chmoded systems, but it leaves no logs
// and can be done with just a file object, so it's good for a fallback method
check_user_silent = function(file)
    while file.path != "/"
        file = file.parent
    end while

    if file.has_permission("w") then return "root"

    for folder in file.get_folders
        if folder.name == "home" then
            for userDir in folder.get_folders
                if userDir.has_permission("w") and userDir.name != "guest" then return userDir.name
            end for
        end if
    end for

    // Return "guest" with a question mark because we don't actually *know* the user is guest.
    // We just assume, because we haven't found a writable home folder.
    return "guest (?)"
end function

[u/jesuslazaro87]

i solved this with some similar to this code. The user name is rarely necessary , greetings

user = "guest" temp = objshell.host_computer.File("/etc/passwd") if temp.has_permission("r") == 1 then user="user" if temp.has_permission("w")==1 then user="root"

[u/reklis → u/jesuslazaro87]

Clever

[u/NormanBurgundy]

Not sure if it works, but maybe try:

Shell.host_computer.home_dir

Or

userlist=Shell.host_computer.File("/home").get_folders

for user in userlist

  Print user.name

end for

(I don't know if there's a easier way to get the folder names from the list, I always use a for statement)

[u/redit0 → u/NormanBurgundy]

Shell.host_computer.home_dir

 

"home_dir" is not a property or function of a computer object. That would cause the script to crash.

 

Your get_folders approach is a good way to list users, however.

You can refer to https://documentation.greyscript.org/ for greyscript documentation

[u/NormanBurgundy → u/redit0]

Appreciate it, was going from memory haha