-
Notifications
You must be signed in to change notification settings - Fork 32
Expand file tree
/
Copy pathhelp.5pk.src
More file actions
2638 lines (2470 loc) · 127 KB
/
help.5pk.src
File metadata and controls
2638 lines (2470 loc) · 127 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
if DEBUG then print("<size=75%>loading help.5pk v 4.3.6...(132.266)")
command.help = function(arg1, arg2, arg3=0, arg4=0)
if arg1 == "help" or arg1 == "-h" then return "helping..."
if arg1 == "shell" then return (colorRed+instance.name+CT+" v "+ver+" by Plu70"+char(10)+"(type<b> shell </b> for more info.)")
if arg1 == "guide" then
print(colorGold+"<u>= = = = = = = = = = = = = =</u>"+CT)
print "<u>""Quick"" start guide/tutorial:"+char(10)+
"The 5hell command prompt is the "+colorWhite+"|>"+CT+" symbol."+char(10)+
"You launch commands from here and return here when they are"+char(10)+
"complete. You may pipe the output of one to the input of another,"+char(10)+
"or chain commands without piping, with "+colorLightBlue+"|"+CT+" and "+colorLightBlue+"||"+CT+" respectively."+char(10)+char(10)+
"5hell features a system called """+colorLightBlue+"glasspool"+CT+""" that mirrors shell objects."+char(10)+
"This means that, wihle active, most of your commands will execute"+char(10)+
"on the target shell instead of locally.Be aware that some commands "+char(10)+
"are local only, meaning they run on the machine running the script, not the active shell."+char(10)+
"The prompt will turn blue, like so: "+colorLightBlue+"|>"+CT+" when "+colorLightBlue+"glasspool"+CT+"is active."+char(10)+char(10)+
colorWhite+"Setup:"+char(10)+
"First, and foremost, set up your email and bank and get a hackshop ip"+char(10)+
"and download metaxploit.so from it. Then launch 5hell and type:"+char(10)+
"<b>kore -r</b> and follow the prompts. Optionally generate the rainbow tables."+char(10)+char(10)+
colorWhite+"<u>Hack your first target (optimized for 10-key pad):"+char(10)
print colorGold+"probe [ip]"+CT+" -- to perform a whois and portscan on a target ip "+char(10)+
colorGold+"-- it sets the target IP in 5phinx (sphinx) as well"+char(10)+
colorGold+"sphinx"+CT+" -- bring up the pentest tool; 5phinx"+char(10)+
"-- "+colorGold+"press [0]"+CT+" to view the portmap again, if you wish"+char(10)+
"-- "+colorGold+"press [4]"+CT+" to change the target ip, if needed"+char(10)+
"-- "+colorGold+"press [5]"+CT+" to change the target port, if needed"+char(10)+
"-- "+colorGold+"press [=] or [+]"+CT+" to connect a local or remote metaLib"+char(10)+
"-- "+colorGold+"press [3]"+CT+" to database the target lib, if unknown "+char(10)+
"---- ignore [1] and [2], for now"+char(10)+
"---- any results obtained by the databasing are stored in the "+colorOrange+"BUFFER"+char(10)+
"-- "+colorGold+"press [left_arrow]"+CT+" (or [7]) to access <b>malp</b> and then "+colorOrange+"[5]"+CT+"for the "+colorOrange+"BUFFER"+char(10)+
"---- use the left arrow key (or [7]) again when you want to return to the main menu"+char(10)+
"-- assuming* you obtained a shell object from the databasing, "+colorGold+"select a shell object by index"+char(10)+
"----* you may need to rerun an attack after fulfilling some requirements"+char(10)+
"----* use the left arrow key (or [7]) to return to the main menu, then:"+char(10)+
"----* "+colorGold+"press [a]"+CT+" to select and fire a single attack from a menu"+char(10)+
"----* return to the buffered shell in malp"+char(10)+
"-- "+colorGold+"press [3]"+CT+" to upload your <b>rkit</b> to the target and automatically launch 5hell"+char(10)+
"-- "+colorGold+"type brutus | gp "+CT+"to do two things:"+char(10)+
"---- get a root shell on the target "+char(10)+
"---- pipe that root shell to "+colorLightBlue+"glasspool"+CT+" for shell mirroring"+char(10)+
"-- "+colorGold+"type /home/guest/rkit/5hell"+CT+" to launch 5hell as root"+char(10)+
"*** "+char(10)+
"Congratulations! You've successfully gotten root on your first target!"+char(10)
print "Use "+colorGold+"felix"+CT+" -- as a file explorer and BUFFER files/folders"
print "Explore the other commands, many are utility. Some are quite advanced."
print "You may hack from the command line, instead of 5phinx, for more precision."
print colorGold+"*--*"
print "By default, <b>/root/rkit</b> is the location of the rootkit and should consist of:"+char(10)+
" <b>5hell, crypto.so, metaxploit.so, database.csv"+char(10)+
"Additionally it may contain:"+char(10)+
"-- <b>dig.bat, 5hell.d, tables/, ScanLan.exe"+char(10)+
"-- and other <b>any</b> scripts/tools/libs/files you find useful"
print colorGold+"*--*"
print "In most cases you may type<b> kore -r</b> to have the rkit built for you"+char(10)+
"-- kore will look for 5hell in /bin, and meta and crypto in /lib"+char(10)+
"-- add these files manually if kore is unable to do so"+char(10)+char(10)
print colorGold+"When you are finished with your hacking:"+char(10)+
colorWhite+"--"+colorGold+"type sc -d</color> to delete your rkit and corrupt the system.log"+char(10)+
colorWhite+"---- this will cover your tracks"+char(10)+
colorGold+"-- you may then safely type <b>exit y<b> to return from your root session"+char(10)+
colorWhite+"---- this will drop you back to the glasspool prompt;"+char(10)+
colorWhite+"---- be paranoid and: <b>sc</b> one last time"+char(10)+
colorGold+"Finally, type exit y"+colorWhite+" to return to your original session with your head held high"
"<b>Additional light reading:"
print "For scripting see:<b> do -h</b>"+char(10)+
"For dictionary attacks see:<b> cerebrum -h, brutus -h, gopher -h, hashim -h</b>"
print "For networking see:<b> air -h, iwlist -h, ifconfig -h, ssh -h, kraken -h</b>"
print"For security see:<b> perms -h, usr -h, grp -h, sniff -h, silentclean -h, bios -h"
print"For dev tools see:<b> scribus -h, makfit -h, clipb -h, make -h, chop -h, dfit -h </b>"
print colorGold+"*--*"
return null
end if
help_summary = "air - open the air suite menu for wifi cracking
append - add text to the end of a file's contents or the clipboard
aptm - open the apt-get menu. also has cli options
bios - display system information or manipulate system objects
brutus - brute force get_shell. escalation tool. req: cerebrum
buffer - add anything to the buffer. supports all data types
cad - cloak and dagger. produces a poisoned ps.src
calc - calculator tools. includes padic representation tool
cat - display text file contents. pipe to poke for concatenation
cc - carbon copy. invoke previous command from cli or menu
cd - change directory
cerebrum - magnum cerebrum. creates or imports onboard dictionary
chop - a kinda weird way to slice/split text (wip)
clear - clear the screen
clipa - alpha clipboard space. stores any data type
clipb - beta clipboard space. stores any data type
clipc - gamma clipboard space. stores any data type
cname - returns the name of the active computer
cob - custom object tools. essential tool
code - multi-tool: ciphers, decompiler, char codes, function exec
cp - copy file. respects glasspool
credits - gratitude
curl - attempt to fetch website.html from piped object
db - dbaser. the databaser tool. essential tool
dfit - mothballed 'dictionary maker' tool
diff - compare two text files. useful for zero day puzzle
dig - dynamic infiltration gremlin. scriptable autohacker
dm - daemon manager. manages daemons
do - loop commands x times. supports strings and batch files
echo - returns it's input. useful for scripting
enum - list enumeration and interation tool. built in 'do'
fakepass - produces poisoned passwd.src
felix - file explorer
fetch - grab metaxploit object or log file from a shell
file - cli file information tool. supports encrypt/decrypt
flood - spam a file x times
fwr - obtain firewall rules from an ip
games - play blackjack, battleship, and Drug Wars
glasspool - glasspool mimic. shell/computer mirroring; essential
glosure - LISP like language for arbitrary runtime code execution
gopher - hash cracker. supports strings and files. stores results
grep - lightweight global regex printer. supports piped objects
grp - view or change group params of users and files
hashim - hash cracker daemon. stores results
help - searchable help system for 5hell
htop - process monitor daemon
if - unintuitive but useful if statement processor
ifconfig - wireless and ethernet cli interface configuration
infil - upload rkit to a target and run 5hell
ipfit - create a string of random ip addresses for piping
iwlist - view nearby wireless network essid, bssid, and pwr
jtr - lightweight john the ripper random password generator
kill - terminate one or more processes by name or pid
kore - goddes of the dead, underworld, grain, and guide to 5hell
kraken - batch rental proxy management. not meant for npc nets!!
lanpro - obtain a string of lan ips on a network
liber - obtain metalib version info for a file or folder
linkdb - load exploits from a database without linking a metalib
lock - secure a system's permissions. uses anti-brick technology
ls - list files in a folder
macro - create macros to perform complex tasks with a single command
mail - herme5 mail system. supports login brute force
make - build a .src file
makfit - rebuild a .src until it's binary is under x bytes
malp - memory alpha. object storage and management; essential
md5 - create or decipher a hash string without storing result
memdump - dump major memory objects to file
merge - append the contents of file b to the bottom of file a
meta - metalib and metaxploit management tool; essential
mkdir - make directory
mv - move or overwrite a file or folder
netdump - dump net session data
nsl - name server lookup. fetch ip for domain and vice versa
nt - open a new terminal window
osint - open source intelligence. find an email
outmon - monitor a file for changes (mothballed)
passwd - change a user's password
pause - pause script execution until a condition is met
perms - alter file permissions. includes a few presets
ping - check to see if an ip responds. marginal actual use
pipe - how piping works. piping itself is not a command
poke - create/confirm a file. supports piping text into it
porter - search a piped list of ips for a specific port
probe - network probe. sumiltanious whois, fwr, lanpro, port info
prox - tunnel through proxy nets to endpoint and start_terminal
ps - list processes. highlights dsession, ps, 5hell
psudo - not-quite-sudo. get_shell and start_terminal tools
purge - session memory wipe tool. aka: the unbufferer
pwd - print working directory
pwgen - markov generator. writes password or hash:password files
quit - exit
rclean - remote clean. copy-over a system.log on a piped object
reboot - reboot the machine
rm - remove a file or folder
rnip - produce a pipable string of random ips (for porter)
roil - fire all known exploits at a linked metalib at once
rshell - place a reverse shell backdoor on a local machine
rsi - server to manage the above reverse shell backdoors
run - launch an external binary. session is preserved
scpm - scp menu. menu and cli upload/download management
scribus - lightweight, MUD style, text editor tool
scrub - shorcut to use kraken to clean all proxy system.logs
shell - print information about the active session
silentclean - scrub log using mv. returns 1 on success
sl - symlink management tool
smtp - returns email info from an smtp server
sniff - wait for ssh connections and print connection info
sphinx - menu based hacking multi-tool
ssh - secure shell connection. supports brute force login
string - advanced string management tool
target - set target ip and port used by various commands
tdump - dump the transmission buffer (hashes) to file
time - return up-time, game time, or game time and date
transmit - send information to a hashim server via ssh
tree - recursive ls. adds hashes found to transmission buffer
tws - track while scanning. advanced BUFFEr querying
usr - add and remove users from a system
whoami - returns active user (or best guess in glasspool)
whois - return brief network info on a given ip or domain
zap - fire a single attack from a list of known exploits
zc - zero chill. zero day assistant tool"
help_conventions = "<b>CONVENTIONS</b>"+char(10)+"While a great deal of 5hell is discordant, there are some conventions:"+char(10)+char(10)+
"You may toggle the full prompt and minimal promt by typing: "+char(10)+
"<b>prompt</b> at the command line"+char(10)+
"- - - - - - - - - - "+char(10)+
colorWhite+"Input: arguments and quote blocks and piping oh my!"+char(10)+
"-- 5hell uses a 4 argument system. This means all commands take at most 4 arguments"+char(10)+
"-- this might sound limiting but it isn't at all in practice. Each of the 4 arguments may be overloaded."+char(10)+
"Some input methods are:"+char(10)+
colorLightBlue+"----* simply typing input: |> ping 1.1.1.1"+char(10)+
"------ up to four typed arguments"+char(10)+
"------ remember that |> is the prompt, you don't type that part"+char(10)+
colorLightBlue+"----* using single quotes to wrap text: |> echo "" this is a text block "" "+char(10)+
"------ would return: this is a text block"+char(10)+
"------ note that: |> echo ""this is a text block"" "+char(10)+
"------ would return: """"this is a text "+char(10)+
"------ this allows you to overload each argument with more than one ""word"""+char(10)+
"------ easy clip and piping and objects(mostly) are preserved inside of text blocks"+char(10)+
"------ <b>you may escape a floating quote with <b>\"""+char(10)+
"--------eg: macro set foo "" echo \"" bar none \"" """+char(10)+
colorLightBlue+"----* use <color=yellow>do</b></color> to run a batch of commands from a file or from memory using an editor"+char(10)+
"------ |> do -- without arguments do will prompt for number of iterations then open the editor"+char(10)+
"------ |> do 1 -- would bring up an editor commands typed here will be executed in order"+char(10)+
"------ |> do 1 ping 1.1.1.1 -- would result in pinging 1.1.1.1 once"+char(10)+
"------ |> do 5 "" rnip 1 | dig "" -- would run dig on a random ip 5 times"+char(10)+
"------ |> do 1 -f /foo.bar -- execute the batch of commands in the file foo.bar"+char(10)+
"-------- you may launch 5hell from the game's command line with <b>do</b> parameters"+char(10)+
"-------- the format is the same as if typing commands on the command line"+char(10)+
"-------- newlines in the script are considered to be new command line entries"+char(10)+
"-------- you may use piping, easy clip, and even calls for <b>do</b> to execute further scripts"+char(10)+
"-------- you may use text blocks for complex commands in place of files or the editor"+char(10)+
"--eg: |> do 3 "" rnip 1 | dig | | cob get metx | meta -i | db -m | zap "" | poke test.txt "" this is a bunch of text going into a file """+char(10)+
colorGold+"** it is possible to almost completely automate every aspect of 5hell via <u>do</u> and <u>dig</u>"+char(10)+
"------ for ease of use <b><color=white>do 1 -f</b></color> has been aliased to <color=white><b>bat</b></color> in 5hell.src:"+char(10)+
"-------- |> <b>bat /foo.bar</b> is equivalent to |> <b>do 1 -f foo.bar</b>"+char(10)+
"------ please see <u><b><color=yellow>do -h</b> and <b>dig -h</b></u></color> for more information on automation"+char(10)+
colorLightBlue+"----* piping input: |> grep -f ^syst | file -p | cp /etc/passwd"+char(10)+
"------ would result in copying /etc/passwd over top of system.log (if permissions allowed it)"+char(10)+
"------ piping allows you to transfer the output of one command to the innput another command"+char(10)+
"------ in the above example the output of grep [args...] is the input of file -p [input]"+char(10)+
"------ and the output of file -p [args] is the input of cp /etc/passwd [input]"+char(10)+
"------ please see <b>pipe -h</b> for more"+char(10)+
"------ if malp is the backbone of 5hell, pipes are the circulatory system of 5hell"+char(10)+char(10)+
colorWhite+"Prompts: "+CT+"|> , :> , ||: "+char(10)+
"<color=#FFFFFF>|> -- this is the standard Command Line Interface prompt"+char(10)+
"-- by default there will be information printed before this"+char(10)+
"-- toggle to a minimalist prompt with: <b>prompt</b>"+char(10)+
"-- fires CLI commands"+char(10)+
colorLightBlue+"|> "+CT+" -- by default, the GLASSPOOL prompt turns the "+colorLightBlue+"|>"+CT+" blue"+char(10)+
"-- this means commands execute on the remote object controlled by glasspool"+char(10)+
"-- see glasspool -h for more"+char(10)+
colorWhite+":> "+CT+" -- this is a liminal prompt, it expects a string or empty return"+char(10)+
"-- this is used to gather user input within a command"+char(10)+
colorWhite+"||: "+CT+" -- this is an 'any key' prompt"+char(10)+
"-- it takes a single keypress"+char(10)+
"-- this is used in 'button' driven menus"+char(10)+char(10)+
colorWhite+"Decision Prompts: "+CT+"[ N/Y/X ] [n/y/x]"+char(10)+
"-- Multiple choice prompts have a default"+char(10)+
"-- the default is always Capitalized and sometimes highlighted"+char(10)+
"-- the default is chosen if <b><enter></b> is pressed without input"+char(10)+
"-- unless otherwise noted, default is chosen if input doesn't match a choice"+char(10)+
"E.G: |> psudo"+char(10)+
"Open shell? [c/y/N]"+char(10)+
"||:"+char(10)+
"-- in this example, the choices are [c], [y], and [N]"+char(10)+
"---- [c] -- enter credentials"+char(10)+
"---- [y] -- open shell"+char(10)+
"---- [n] or anything else -- no; return/abort"+char(10)+
"------ this is because N is the default"+char(10)+char(10)+
colorWhite+"Prompt: advanced:"+char(10)+
"-- by default the prompt will display the public and local ip of the active shell"+char(10)+
"---- or computer if using glasspool on a computer object"+char(10)+
"-- by default the prompt will display computer name and working directory"+char(10)+
"-- by default the prompt indicates user privileges (root,user,guest) with:"+char(10)+
"---- under the ip information there will be a:"+char(10)+
"------ a<color=red> red line for root</color>, <color=green>green line for user </color>, </color>and <color=white>white line for guest"+char(10)+
"---- please note that user permissions are determined by access level"+char(10)+
"---- in some cases, this might not be the actual user"+char(10)+
"-- you may customize the prompt to your liking in 5hell.src"+char(10)
help_tools = "<u><b>Main tools:"+char(10)+
colorCyan+"probe "+colorWhite+"-- whois and portmap a target"+char(10)+
colorCyan+"db "+colorWhite+"-- scan target and <b>database results</b>"+char(10)+
colorCyan+"meta "+colorWhite+"-- metaLib and metaxploitLib fine control"+char(10)+
colorCyan+"zap "+colorWhite+"-- select and fire exploits one at a time (does not database)"+char(10)+
colorCyan+"roil "+colorWhite+"-- fire all exploits at once (does not database)"+char(10)+
colorCyan+"malp "+colorWhite+"-- Memory Alpha: BUFFER management"+char(10)+
"-- exploit results and other objects go here"+char(10)+
"-- this is arguably the backbone of 5hell"+char(10)+
colorCyan+"scpm "+colorWhite+"-- menu and/or cli driven scp"+char(10)+
colorCyan+"kraken "+colorWhite+"-- proxy management"+char(10)+
colorCyan+"scribus "+colorWhite+"-- simple text editor"+char(10)+
colorCyan+"cerebrum "+colorWhite+"-- add 325k+ passwords to custom_object.dictionary"+char(10)+
colorCyan+"brutus "+colorWhite+"-- use custom_object.dictionary to get root on any (unmodified) npc machine"+char(10)+
colorCyan+"See: [command] [-h|help] for more help on these and other commands"+char(10)
help_buffer = colorOrange+"The BUFFER"+char(10)+
colorOrange+"</b>The BUFFER stores objects. Anything may be stored in the BUFFER."+char(10)+
colorOrange+"You access the BUFFER with the <b>malp</b> command >> option [5]"+char(10)+
colorOrange+"</b>When an exploit is run, the result is stored in the BUFFER. You"+char(10)+
colorOrange+"</b>may interact with these objects in a number of ways by selecting them"+char(10)+
colorOrange+"</b>from the list and using their context menu (if the object has one)."+char(10)+
colorOrange+"</b>One way to fetch an object from the BUFFER for use elswhere is to use the clipboard:"+char(10)+
colorOrange+"</b>|> "+colorGreen+"clipb @B [index|-m]</color>"+colorOrange+"</b>-- where index == BUFFER[index]"+char(10)+
colorOrange+"</b>-- then pipe the value to another function"+char(10)+
colorOrange+"</b>Easy Clip! As of version 3.9.6 any command may take <b>@B [index|-m] as one or more parameters!"+char(10)+
colorOrange+"</b>-- if -m is passed instead of an index, a menu is displayed"+char(10)+
colorOrange+"</b>|> roil | scpm /root/rkit @B -m"+char(10)+
colorOrange+"You may pipe anything into the buffer with |><b> [command_returning_input] | malp</b>"+char(10)+char(10)+
colorGreen+"Easy Clip! You may reference the clipboards with the @ symbol:"+char(10)+
colorGreen+"*** clipa, clipb, and clipc are all clipboard spaces ***"+char(10)+
colorGreen+"</b>You may use @a, @b, and @c to reference their values"+char(10)+
colorGreen+"</b>e.g. echo hello world | clipa | | poke hello.txt @a"+char(10)+
colorGreen+"*** tbuf, home, do ***"+char(10)+
colorGreen+"</b>e.g. <b>gopher @tbuf</b>, e.g. <b>rshell @home</b>, e.g <b>scribus @do"+char(10)+char(10)+
colorCyan+"</b>The CUSTOM_OBJECT is a way for scripts to share information between"+char(10)+
colorCyan+"</b>nested launches. This means you can launch 5hell with 5hell and pass objects back and forth."+char(10)+
colorCyan+"</b>You interact with the custom_object via the various <b>cob</b> commands"+char(10)+
colorCyan+"</b>Namely: cob get and cob set."+char(10)+
colorCyan+"For ease of use: <color=white>cob get</color> and <color=white>cob set</color> have been aliased to:"+char(10)+
colorCyan+"</b>-- <color=white>get</color> and <color=white>set</color> in 5hell.src"+char(10)+
colorCyan+"</b>-- |> <b>cob set bob burger </b>is equivalent to |><b> set bob burger"+char(10)+
colorCyan+"</b>-- |> <b>cob get bob</b> is quivalent to |><b> get bob"+char(10)+
colorCyan+"</b>An example would be "+colorGold+"cerebrum</color> which loads the dictionary to the custom object."+char(10)+
colorCyan+"</b>-- When generated, the dictionary is loaded to the custom object under the key: <b>dictionary</b>."
colorCyan+"</b>-- Once loaded, you may <b>run</b> 5hell through nested launches and the dictionary will persist."+char(10)+
colorCyan+"</b>-- This also allows you to import/export metaLib's and metaxploitLib's between machines!"+char(10)
colorCyan+"</b>-- Easy Clip! You may reference a value in the custom object by it's key with: <b>@o [key]</b>"+char(10)+
colorGold+"</b>--eg:<b> set foo "" look out for that tree, "" | echo @o foo george </b>// look out for that tree, george"+char(10)+
colorCyan+"</b>-- Please see cob -h for more informaiton"
help_logs = colorWhite+"The dreaded "+colorRed+"System.log"+char(10)+
"Actions that generate an entry in system.log: "+char(10)+
"-- establishing a net_session on a server (not a router)"+char(10)+
"-- connecting via Browser.exe to a server"+char(10)+
colorWhite+"---- connection established on port ##"+char(10)+
"-- obtaining a shell (server/router)"+char(10)+
colorWhite+"---- shell obtained on port ##"+char(10)+
"-- deleting a file"+char(10)+
colorWhite+"---- file deleted [ip]"+char(10)+
"-- routing a connection with:"+char(10)+
"-- connect_service or file_explorer"+char(10)+
colorWhite+"---- connection routed [ip]"+char(10)+
"-- shell disconnect"+char(10)+
"-- i.e. exiting from start_terminal"+char(10)+
colorWhite+"---- connection closed [ip]"+char(10)+char(10)+
colorRed+"Active Traces"+CT+" will start when <b>shell.start_terminal</b> is used"+char(10)+
"on an npc machine with an active admin of sufficient knowledge and give-a-damn."+char(10)+
"Generally, if there is a root: dsession active, using start_terminal will trigger"+char(10)+
"an active trace. Active traces are stopped by disconnecting (exiting) that terminal instance."+char(10)+char(10)+
"When using 5hell you should NOT ever open a terminal (on a target) unless you are doing an Academic or"+char(10)+
"Police record mission. OR if you absolutely need to open the browser to edit firewall or port rules"+char(10)+
"on a target. Otherwise, use <b>glasspool</b> and <b>run</b> to leverage shell object manipulation instead."+char(10)+char(10)+
"However! You <u>should</u> start_terminal on your end point attack proxy. In fact, do it twice:"+char(10)+
"-- use <b>prox</b> to tunnel to your end point proxy then launch 5hell and type <b>psudo</b> and then select [y]"+char(10)+
"-- this will start_terminal on top of your start_terminal, effectively looping your connection on that machine"+char(10)+
"-- this will ensure your end point proxy's ip is left in logs, not your origin ip"+char(10)+
"-- without this, you risk exposing ip's behind the proxy"+char(10)+
"-- note: this means you'll have to 'exit' twice from that proxy to return home"+char(10)+
colorRed+"Passive Traces"+CT+" can/will start when certain actions have been left unaddressed:"+char(10)+
"- Deleting a file and not removing the log entry"+char(10)+
"- Leaving a connection closed log without a corresponding connection established log"+char(10)+
"- Leaving a shell connected log at all"+char(10)+
"- I think connection routed logs trigger traces, too. Not sure though."+char(10)+char(10)+
colorMagenta+"We all leave logs, sometimes. To clean them up, here are a few methods:"+char(10)+
colorLightBlue+"Silentclean "+CT+"-- local log corruption using a text file"+char(10)+
"-- creates a file used to corrupt logs"+char(10)+
"-- has nuke option (see: silentclean -h)"+char(10)+
colorCyan+"Rclean "+CT+"-- remote (or local) log corruption using objects"+char(10)+
"-- uses a file already on system to corrupt logs"+char(10)+
"-- accepts and works on piped objects (see: rclean -h)"+char(10)+
colorGold+"MV "+char(10)+"-- yep, just the <b>mv</b> command"+char(10)+
"-- poke haha | mv haha /var/system.log"+char(10)+
colorOrange+"Wiping the log with one of these methods using a reverse shell is best"+char(10)+
"but not necessary. You may run silentclean, exit 5hell, exit the terminal, and you will not leave a disconnect log."+char(10)+
"-- be aware that taking any log-creating action after running sc, except exiting, may regenerate the log."+char(10)
help_alias = "<u><b>aliases || do script || shortcuts || macros || User Defined Behavior"+char(10)+
"5hell can be very simple to use, or very, very complicated, depending on your goals."+char(10)+
"It isn't necessary to learn 100% of 5hell. Nor is it necessary to suffer through some of it's"+char(10)+
"more complex chains of commands. You can define your own behavior in a number of ways:"+char(10)+char(10)+
colorLightBlue+"Aliases: "+char(10)+
colorWhite+" You may define aliases in the aliases section of 5hell.src"+char(10)+
colorWhite+"the default ones supplied are all prompt replacements. There are also 'easy clip' defenitions"+char(10)+
colorWhite+"that replace arguments in the user input with, for instance, the contents of a clipboard or"+char(10)+
colorWhite+"your @home server ip. These hard coded aliases may be more complicated than a simple"+char(10)+
colorWhite+"word or string replacement. You may, for instance, have a simple two word alias fire"+char(10)+
colorWhite+"a whole series of commands. This might be considered a macro at that point, but also"+char(10)+
colorWhite+"might not quite qualify."+char(10)+char(10)+
"Here is a list of the currently defined default aliases in 5hell.src:"+char(10)+
colorLightBlue+"Alias | Definition"+char(10)+
colorCyan+"bat [path] |</b> do 1 -f [path]"+char(10)+
colorCyan+"set [key] [val] |</b> cob set [key] [val]"+char(10)+
colorCyan+"get [key] |</b> cob get [key]"+char(10)+
colorCyan+"inspect [key] |</b> cob inspect [key]"+char(10)+
colorCyan+"lock |</b> perms lock all"+char(10)+
colorCyan+"exit |</b> quit"+char(10)+
colorCyan+"sc [opt] |</b> silentclean [opt]"+char(10)+
colorCyan+"gp [#] |</b> glasspool [#]"+char(10)+
colorCyan+"prompt |</b> -this will toggle the full_prompt on/off-"+char(10)+char(10)+
colorWhite+"Easy Clip |</b> Replacement"+char(10)+
colorGold+"@a |</b> clipa -- globals.CLIP[""a""]"+char(10)+
colorGold+"@b |</b> clipb -- globals.CLIP[""b""]"+char(10)+
colorGold+"@c |</b> clipc -- globals.CLIP[""C""]"+char(10)+
colorGold+"@tbuf |</b> transmission buffer -- globals.T_BUF"+char(10)+
"-- this is |</b> where hashes go when the tree command finds them"+char(10)+
colorGold+"@t |</b> targetIP"+char(10)+
colorGold+"@p |</b> targetPort"+char(10)+
colorGold+"@home |</b> get_custom_object.HOME server ip address defined in 5hell.src"+char(10)+
"-- this is |</b> usually an attack proxy running ssh and rshell servers"+char(10)+
"-- please don't |</b> use your actual home pc for this"+char(10)+
colorGold+"@B [index|-m] |</b> directly reference a value in the"+colorOrange+" BUFFER "+CT+"by [index] or menu: [-m]"+char(10)+
colorGold+"@o [key] |</b> directly reference a value in the custom object by key"+char(10)+
colorGold+"@r [index] |</b> directly reference a shell in the rsi buffer by [index] or menu: [-m]"+char(10)+
colorWhite+"All <b>@</b> aliases (known as ez_clips) may be escaped with the <b>\</b> character:"+char(10)+
"<size=75%>--eg: <b>\@a</b>, \@home"+char(10)+
"<size=75%>--eg: <b>clipa bob || echo @a -- will echo 'bob', while "+char(10)+
"<size=75%>--eg: <b>clipa bob || echo \@a -- will echo '@a' "+char(10)+char(10)+
"Please note: several commands have their own references for editing the clipboards"+char(10)+
"-- these commands will use @clipa, @clipb, @clipc instead of @a, @b, @c"+char(10)+
"Further, the clipa, clipb, and clipc will use @B to reference the BUFFER:"+char(10)+
"-- e.g: |> <b>clipa @B 1</b> -- copy the object at index 1 in the BUFFER to clipa"+char(10)+
"---- that object may then be used by other commands that accept piped objects as input"+char(10)+
"-- as of 3.9.6 any command may use @B [index] as any parameter(s)"+char(10)+
"-- there are other ways to pipe objects around besides the clipboards, explore to learn more."+char(10)+
char(10)+
colorOlive+"Marcos and Automation: "+char(10)+
colorWhite+"<size=75%></b>You may define custom macro's with the "+colorOrange+"</b>macro</color> command. A macro is a "+char(10)+
colorWhite+"<size=75%></b>runtime-defined set of instructions executed by a single command. Think of it as an alias that performs"+char(10)+
colorWhite+"<size=75%></b>commands for you. Additionally, you may execute batch commands either from a file or from memory. There are"+char(10)+
colorWhite+"<size=75%></b>a few differences between a <u>macro</u> and a <u>do script</u>."+char(10)+
colorWhite+"<size=75%></b>Please see: "+colorLightBlue+"</b>do -h, macro -h, and help automation for more information on this topic."+char(10)
help_automation = "<u><b>automation || macro || do script || batch file"+char(10)+
colorCyan+"How to fully automate <color=red>5</color><color=white>hell</color>:"+char(10)+
colorWhite+"</b> As mentioned in <b>help alias</b>, you may define custom macro's, or sets of commands"+char(10)+
colorWhite+"</b>that <color=red>5hell</color> will execute automatically. The two commands involved are:"+char(10)+
colorOrange+"--: </b>macro</color> and "+colorOrange+"</b>do"+char(10)+
colorWhite+"</b>The two commands function similarly in that they execute the defined commands as "+char(10)+
colorWhite+"</b>if they were typed by you. The list of commands, or 'script,' is formed the same "+char(10)+
colorWhite+"</b>way for both commands. Therefore both commands may execute the same scripts. That is, "+char(10)+
colorWhite+"</b>do may execute a macro, and macro may execute a do script. This way, don't have to "+char(10)+
colorWhite+"</b>remember two different formats for these similar commands."+char(10)+
colorWhite+"</b>The specific behavior of each is as follows:"+char(10)+
colorOrange+"DO: "+char(10)+
colorCyan+" Do is essentially a 'do while' loop that executes at least once. You specify the number "+char(10)+
colorCyan+"</b>of loops with the first argument: <b>do [some integer]</b> "+char(10)+
colorCyan+"</b>The <b>primary</b> way to use do is like a macro that you want repeated on a loop."+char(10)+
colorCyan+"</b>If there are no more arguments after the number, an editor will open (scribus) where you may"+char(10)+
colorCyan+"</b>type out the commands you want executed line by line. Lines may be complex lines, that is, "+char(10)+
colorCyan+"</b>the lines may include piping. The output of a line will <b>not</b> be passed to the following "+char(10)+
colorCyan+"</b>line. This way, you may type out commands without using the <b>| |</b> trick. Once "+char(10)+
colorCyan+"</b>you type <b>@</b> on a new line, the script will begin executing. Use <b>@@</b> on a new line"+char(10)+
colorCyan+"</b>to abort execution. Additionally, you may use<b> scribus @do</b> to edit the buffer without executing."+char(10)+
colorCyan+"</b>You may then fire it later with<b> do [#]</b> and then <b>@</b>."+char(10)+
colorLightBlue+"An example do script, either written in the editor or read from a file* (*explained in the third usage): "+char(10)+
colorGold+"</b>ifconfig -p | probe"+char(10)+
colorGold+"</b>brutus | clipb"+char(10)+
colorGold+"</b>grep -p 5hell | clipc"+char(10)+
colorGold+"</b>run @c "" do 1 rshell @home "" @b"+char(10)+
colorGold+"</b>rclean @b"+char(10)+
colorLightBlue+"</b>This would result in a network probe, an escalation, a root rshell placement, and "+char(10)+
colorLightBlue+"</b>finally a log scrub. This is useful to run each time you attack a new target and "+char(10)+
colorCyan+"</b>is also included as the default <b>dig.bat"+char(10)+
char(10)+
colorCyan+"</b>The <b>Second</b> way to use do is to define the commands on a single line, wrapped by floating quotes. "+char(10)+
colorLightBlue+"</b>This would look like:<b> do 5 "" rnip 1 | ping 1.1.1.1 """+char(10)+
colorLightBlue+"</b>This results in pinging 1.1.1.1 five times. More complex commands may be further chained by piping. "+char(10)+
colorLightBlue+"</b>Be sure to wrap the commands you wish to <b>do</b> in quotes* that do not touch anything "+char(10)+
colorLightBlue+"</b>(ie, floating) as shown above."+char(10)+
colorLightBlue+"<b>* If the command string is only two words, quotes are not needed. eg: do 1 ping 1.1.1.1"+char(10)+
char(10)+
colorCyan+"The <b>Third</b> way to use do is to read defined commands from a file."+char(10)+
colorLightBlue+"</b>The commands in the (text) file are written exactly as they are when using the editor to list commands."+char(10)+
colorLightBlue+"</b>These commands are executed with:<b> do [#] -f [pathToFile]"+char(10)+
colorLightBlue+"</b>For your convenience, the alias "+colorGold+"</b>bat [path]</color> will be relaced by <b>do 1 -f [path]"+char(10)+
colorLightBlue+"</b>This is most useful when launching 5hell with a set of instructions. If you launch 5hell from the command "+char(10)+
colorLightBlue+"</b>line with: <b>5hell do 1 -f [path] </b>5hell will automatically execute the commands in the file and then exit."+char(10)+
colorLightBlue+"</b>If you do not wish 5hell to exit after completion, use a file named <b>do.rc</b> in your home_dir/Config or"+char(10)+
colorLightBlue+"</b>in rkit (executes only if ~/Config/do.rc does not exist). Note that <b>do</b> does not return a value other than"+char(10)+
colorLightBlue+"</b>it's completion time. Macros, however, do return the final value. Additionally, the <b>dig</b> command makes"+char(10)+
colorLightBlue+"</b>use of the <b>do</b> engine when executing <b>dig.bat</b> (which itself, may reference other do scripts). "+char(10)+
colorLightBlue+"</b>This allows 5hell to be fully automated throughout an arbitrary number of attacks. Cool stuff, right!?"+char(10)+
char(10)+
colorGold+"Macro:"+char(10)+
colorWhite+"</b>A macro is similar to a do script, except it is intended to be written 'on the fly.' In other words, you type "+char(10)+
colorWhite+"</b>the macro definition on the command line, without the editor, in most cases. If you do wish to use the editor, "+char(10)+
colorWhite+"</b>simply use: <b>scribus @clipa/b/c | macro set [macro_name]"+char(10)+
colorWhite+"</b>Marco's are stored in the custom object and are executed when called by name: <b>macro [name]"+char(10)+
colorWhite+"</b>A macro <b>will</b> return it's final value and will not print execution time. There is no built in option "+char(10)+
colorWhite+"</b>to read a macro from a file, however <b>cat [file] | macro set [name]</b> may be used to achieve this."+char(10)+
colorWhite+"</b>An example macro definition:"+char(10)+
colorWhite+"macro set prop "" cp 5hell /bin | cp /bin/5hell rkit | kraken /bin/5hell | kraken rkit/5hell """+char(10)+
colorWhite+"</b>Again, it looks exactly the same as an inline do script, because it is! However, this script is stored "+char(10)+
colorWhite+"</b>in the custom object, meaning it's string may be retrieved with <b>get macro.[name]</b> and piped somewhere,"+char(10)+
colorWhite+"</b>such as to a file. You may absolutely fire a macro with <b>do</b>. Simply type: <b>do [#] @o [macroName]</b>"+char(10)+
colorWhite+"</b>and do will happily execute the macro. Likewise, as mentioned earlier, piping the </b>contents of a "+char(10)+
colorWhite+"</b>do script to macro will define the macro as that do script."+char(10)+
char(10)+
"This all may seem complicated, but it is actually rather simple: "+char(10)+
"--define a list of commands as if you were typing them, fire the batch of commands."+char(10)+
"For more information, please see: <b>do -h, macro -h, dig -h</b>, help alias, and help conventions."+char(10)+
"Also, visit the 5hell discord for example scripts!"
help_daemon = colorWhite+colorRed+"</b>5</color>hell has a handful daemon commands: htop, hashim, outmon, and rsi."+char(10)+
colorWhite+"Three of these commands; htop, hashim, and outmon, are controlled by a 'daemon controller.' "+char(10)+
colorWhite+"This controller functions by creating a file named<b> 5hell.d</b> in your root directory and writes a"+char(10)+
colorWhite+"line to that file that matches a daemon process that is running. When this line is removed from the file, or"+char(10)+
colorWhite+"or the file itself is deleted, the daemon process will end. This allows you to start and stop daemons in 5hell"+char(10)+
colorWhite+"without having to kill the whole script with ctrl+c. Note that rsi is not controlled by the daemon manager as it"+char(10)+
colorWhite+"exits daemon mode when a reverse shell connects to it."+char(10)+
"See also: htop -h, hashim -h, outmon -h, rsi -h"
if arg1 == "-s" or arg1 == "show" or arg1 == "search" then
c_buf = []
h_buf = []
for cmd in command.indexes.sort
if cmd == "shell" or cmd == "help" or cmd == "__isa" or cmd == "classID" then continue
h = @command[cmd]
c_buf.push(colorWhite+cmd+CT)
c_buf.push(h("help"))
end for
c_buf.push(colorWhite+"shell"+char(10)+"Usage: shell -- outputs instance_name, num_commands and dictionary_size.")
c_buf = c_buf+[help_buffer,help_conventions,help_logs,help_tools,help_alias]
if arg2 then
invoke_regex = false
special_chars = ["*","^","$","#"]
for special in special_chars
if arg2.indexOf(special) >= 0 then invoke_regex = true
end for
for c in c_buf
found = false
if not invoke_regex then
if c.indexOf(arg2) >= 0 then
found = true
end if
else
for w in c.split(" ")
if globals.re.match(arg2.values, w.values) then
c = c.replace(w,colorRed+w+CT)
found = true
end if
end for
end if
if found then h_buf.push( c.replace(arg2, colorRed+arg2+CT) +char(10)+ colorGold+"<u>---</u>"+ CT +char(10) )
if DEBUG then print(h_buf[-1])
end for
return colorGold+"<u>= = = = = = Help Search = = = = = =</u>"+char(10)+colorLightBlue+"Found: </b>"+h_buf.len+"<b> results."+CT+char(10)+h_buf.join(char(10))
end if
return c_buf.join(char(10))
end if
if arg1 == "home" then
return " Convention: <b>@home</b> -- indicates a server you, the end user, have set up for 5hell"+char(10)+
"services. Servers should be of type <b>SSH</b> and/or <b>RSHELL</b> and it is recommended to run:"+char(10)+
"<b> pwgen | pwgen hash</b>"+char(10)+
"on ssh servers running the <b>hashim daemon</b>. The @home server is used by:"+char(10)+
"<b> cerebrum, brutus, linkdb, transmit, and rshell/rsi</b>"+char(10)+
"For example: <b>rshell @home notAvirus</b> would create an rshell with ip set as your @home server."+char(10)+
"That server would be running the rshell_server used by the rsi command. An @home server may also run:"+char(10)+
"<b> hashim, outmon, or other custom services</b>. Please contact Plu70 if you have questions about setting"+char(10)+
"up these resources."+char(10)+
"Please edit the appropriate line in 5hell.src to setup @home by providing an ip address, port, password,"+char(10)+
"and directory for the pass file. It is important that you secure 5hell with login authentication,"+char(10)+
"either stock or your own, to prevent exposure of this information! "
end if
if arg1 == "--summary" then return help_summary
if arg1 == "-A" or arg1 == "alias" then return help_alias
if arg1 == "-c" or arg1 == "conventions" or arg1 == "-p" or arg1 == "prompt" then return help_conventions
if arg1 == "-t" or arg1 == "tools" then return help_tools
if arg1 == "-b" or arg1 == "buffer" then return help_buffer
if arg1 == "-l" or arg1 == "logs" then return help_logs
if arg1 == "-a" or arg1 == "automation" then return help_automation
if arg1 == "-d" or arg1 == "daemons" or arg1 == "daemon" then return help_daemon
index = command.indexes
if index.indexOf("__isa") != null then index.remove( index.indexOf("__isa"))
if index.indexOf("classID") != null then index.remove( index.indexOf("classID"))
if arg1 != "-i" then
index = index.sort
end if
num_commands = index.len
columns = 8 // # commands per line
if globals.DEBUG then print("commands: "+num_commands+" columns: "+columns)
rows = ceil(num_commands / columns)
if globals.DEBUG then print("rows: "+rows)
buf = []
count = 0
for i in range(0,rows)
//buf.push("<color=#FFFFFFFF><b>"+index[count:count+columns].join(" "))
buf.push(colorWhite+index[count:count+columns].join(" "))
count = count + columns
end for
print(colorGold+"- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -"+CT)
print(format_columns(buf.join(char(10))).replace("sphinx", "<color=#FF0000FF>sphinx</color>" ) )
print(colorGold+"- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -"+CT)
print(":><b> help</b> -- print this page: lists commands alphabetically")
print(":><b> help guide</b> -- for a quick getting started guide")
//print(":> help [-c|conventions] -- information about 5hell prompt conventions")
print(":> help [-p|prompt|-c|conventions] -- information about 5hell prompt conventions")
print(":> help [-t|tools] -- a short list of the main tools")
print(":> help [-a|automation] -- print information about automating tasks")
print(":> help [-d|daemon|daemons] -- information about daemon control")
print(":> help [-A|alias] -- a list of the current default aliases in 5hell.src")
print(colorOrange+":> help [-b|buffer] -- buffer, clipboard, and custom_object info")
print(":> help [-l|logs] -- information regarding system.log")
print(":> help [-s|show|search] -- for a full descriptive list of commands")
print(":> help [--summary] -- print a summary of all commands")
print(colorCyan+":> help [-s|show|search] [word|string|regex] -- search all help info for pattern"+char(10)+"-- see grep -h for regex tokens")
print(":> help [-i] -- list commands by command map index")
print(":> help [home] -- information about the @home system")
print(":> lock -- shortcut for perms lock all")
print(":> prompt -- toggle full_prompt on and off")
print(colorCyan+":> [command] [-h|help] -- for more information on a specific command."+char(10))
return null
end function
//////////////
////////////// 5phinx F1 usage info ////////////
//////
sphinx_help = function()
print(colorRed+"Sphinx</color> v" + sphinx_version + ",<color=white> by Plu70 </b></color>running on localhost: "+localmachine.local_ip)
print("<b>////////////////////////////////////////////</b>"+CT)
print("<b>Press the key in </b>[ ]<b>'s to activate a command:")
print("A MetaLib is a scanned library (e.g. libssh 1.0.1) aka a<b> lib </b>")
print("A vuln is a vulnerability in a MetaLib that may be exploited")
print
print(colorWhite+"To begin, select an ip and port to target:")
print(colorCyan+"</b>["+colorWhite+"4</b></color>] or ["+colorWhite+"i</b></color>] - set target IP and port \n-- <b>leave blank to default to current gateway")
print(colorCyan+"</b>["+colorWhite+"5</b></color>] or ["+colorWhite+"p</b></color>] - manually change target port without changing target IP")
print(colorCyan+"</b>["+colorWhite+"0</b></color>] or ["+colorWhite+"w</b></color>] - port scan (nmap) target IP"+char(10)+
"-- if target IP is not a router, 5phinx will attempt to locate the router, halfheartedly")
print(colorCyan+"</b>["+colorWhite+"+</b></color>] or ["+colorWhite+"=</b></color>] - connect or load MetaLib"+char(10)+
"--: [<b>y</b>] or <b>enter</b> establishes a net_session</b> "+char(10)+
"--: this leaves a connection established log on servers but not on routers"+char(10)+
"--: selecting [<b>l</b>] instead loads a <b>local lib</b> for scanning/exploiting")
print("--: if the target MetaLib is known in the database 5phinx will automatically link the entry\n--: and load the vulns (xploits) into memory")
print("["+colorWhite+"-</b></color>] - will unload the currently loaded MetaLib and clear vulns in memory")
print(colorCyan+"</b>["+colorWhite+"1</b></color>] or ["+colorWhite+"s</b></color>] - scan MetaLib at target IP:port and load vulns (xploits) into memory."+char(10)+
"--: this does <u>not</u> update the database"+char(10)+
"--: while the vuln requirements may be viewed in malp option [2] "+char(10)+
"--: the information is not stored"+char(10)+
"--: this is useful if you: want to scan a target without writing to the target's filesystem"+char(10)+
"--: or you want to scan a target without overwriting you current database entry")
print(colorCyan+"</b>["+colorWhite+"2</b></color>] or ["+colorWhite+"r</b></color>] - perform 'hail mary' attack using all vulns (xploits) loaded into memory"+char(10)+
"--: does not database results")
print(colorCyan+"<b>["+colorWhite+"3</b></color>] or ["+colorWhite+"d</b></color>] - scans the target IP and port"+char(10)+
"--: if a local metaLib has been loaded with [<b>=</b>] then db will database that instead of the target IP"+char(10)+
"--: attacks using all exploits found"+char(10)+
"--: <b>updates the database</b> with the results</b>"+char(10)+
"--: loads vulns (xploits) to memory"+char(10)+
"--: will overwrite the entry if a lib is databased again"+char(10)+
"--: it is not necessary to link a remote lib with [=] to use db on a remote target")
print(colorCyan+"["+colorWhite+"a</b></color>] - select a single attack from memory to launch at the target"+char(10)+
"--: the same as the <b>zap</b> command"+char(10)+
"--: to manually enter a [mem] [string] press enter at the menu and fill in the values")
print(colorCyan+"</b>["+colorWhite+".</b></color>] - run the <b>dig</b> command against the target (see dig -h)"+char(10)+
"--: if dig.bat is not in rkit, a very basic dig.bat will be created"+char(10)+
"--: edit dig.bat to perform whatever tasks you want dig to auto-execute when attacking the target"+char(10)+
"--: dig uses the 'do' command to perform actions"+char(10)+
"--: you may include instructions in dig.bat to launch other bat files with do"+char(10)+
"--: any bat file, including dig.bat, may contain a call to shell.launch 5hell with a 'do' launch parameter"+char(10)+
"--: this allows you to spread 5hell like the plague"+char(10)+
"--: dig does not support digging /lib, use a do script for that")
print(colorCyan+"</b>["+colorWhite+"*</b></color>] or ["+colorWhite+"/</b></color>] - run <b>db</b> against all libs or ports in /lib or at target IP"+char(10)+
"--: if a local lib is linked then all libs in /lib will be databased"+char(10)+
"--: if no lib is linked then all libs in /lib will be databased"+char(10)+
"--: link a net_session with a port or router on the target to db all reachable ports")
print("--:<b> all results from <b>[2], [3], [.], [*], and [a]</b> "+char(10)+
"--: are sent to the "+colorOrange+"BUFFER</color></b> in memory alpha")
print("[6] - access the mail command"+char(10)+
"--: may also use the down arrow key")
print(colorCyan+"<b>["+colorOrange+"7</b></color>] or ["+colorOrange+"m</b></color>] - access the malp command (Memory Alpha)\n--: you may also use the <u>"+colorOrange+"left_arrow</u>"+CT+" key")
print("--: from malp select "+colorOrange+"[5] to access the BUFFER")
print("[8] - access an extra menu, may also use the right arrow key")
print("[9] - access bank heist, may also use the up arrow key\n--: n.b. bank heist is kinda crappy\n--: and bank accounts contain almost nothing")
print(colorCyan+"</b>["+colorWhite+"z</b></color>] - wipe the local system.log"+char(10)+
"--: sets log to a text file of size 0"+char(10)+
"--: when returning to 5phinx's main menu, if the log has changed, an alert will print")
print("["+colorWhite+"F1</b></color>] or [?] - access this help file ")
print("[<b>q</b>] - leave 5phinx and return to 5hell \n--: preserves state so you may return"+char(10)+"--: shares state with 5hell")
print
print("n.b. running <b>probe [ip [port] from 5hell's cli will set the target IP and port for 5phinx")
print("n.b. <b>zap</b> in 5hell is the same as [<b>a</b>] in 5phinx")
print("n.b. <b>roil</b> in 5hell is the same as [<b>2</b>] in 5phinx")
print("n.b. <b>meta link|load</b> in 5hell is the same as [<b>=</b>]/[<b>+</b>] in 5phinx")
print("n.b. <b>database.csv</b> is always <b>written</b> to /root/rkit/database.csv")
print("n.b. <b>database.csv</b> may be read from anywhere (uses first copy found on system)")
print("n.b. convention is to keep a copy of 5hell, metaxploit, crypto, database.csv"+char(10)+
"--: in /root/rkit along with other useful tools for easy uploading"+char(10)+
"--: you may use <b>kore -r</b> to quickly construct the rkit")
print
print("5hell/5phinx does not phone home and therefore does not autoupdate"+char(10)+
"--: 5hell is now open source so the above is a moot point")
print("5hell/5phinx is a product of Ra'al Tek and is written by jhook777 aka Plu70 aka Ra'al")
print("all rights reserved 2020-2025")
print
end function
///////////////// end 5phinx help ////////////
//
////////////////// GAMES ///////////////
// start games made by Plu70
bat = function(s)
// battleship by Plu70, aka ra'al, aka jhook777 2021
// start with 10 x 10 grid
// 24.905kb
// valid launch params:
//
// -c -- all color lines are null
// -d -- debug mode, no wait(1)'s and verbose
// -dt - early terminate: spawn ships, print locations and end
// -s -- self play: ai vs rng
// -cd, -cd -s, -d -s, -c -s, also valid combinations
//
// order matters with launch params
// ai is marginally better than random*
////////////////////////
game_file = null // single player for now
DIFFICULTY = "hard" // lol jk, still need better ai algorithm. easy or medium available at runtime
EARLYTERM = false
self_play = false
//if params.len >= 1 and (params[0] == "-s" or params [1] == "-s") then self_play = true
//debug = globals.DEBUG
disable_color = false
/////////
if s == "-s" then self_play = true
////////////////////////
globals.MIN = 0 // minimum X/Y values for grid size
globals.MAX = 9 // maximum X/Y values for grid size
rng = range(MIN,MAX)
rnd = range(MIN,MAX)
rng.shuffle
rnd.shuffle
///BEGIN GRAPHICS//////
print_logo = function()
print(colorRed+" _ _ _ _ _ _ "+CT)
print(colorGreen+"| | | | | | | | | | (_) "+CT)
print(colorGreen+"| |__ __ _| |_| |_| | ___ ___| |__ _ _ __ "+CT)
print(colorGreen+"| '_ \ / _` | __| __| |/ _ \/ __| '_ \| | '_ \ "+CT)
print(colorRed+"| |_) | (_| | |_| |_| | __/\__ \ | | | | |_) | "+CT)
print(colorGreen+"|_.__/ \__,_|\__|\__|_|\___||___/_| |_|_| .__/ "+CT)
print(colorGreen+" | | "+CT)
print(colorGreen+" |_| "+CT)
end function
display_ship_one = function()
ship_one = [" .", " # # ( ) "," ___#_#___|__ ", " _ |____________| _ ", " _=====| | | | | |==== _ ", " =====| |.---------------------------. | |==== ", " <--------------------' . . . . . . . . '--------------/ ", " \ / ", colorLightBlue+" wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww "+CT, colorLightBlue+"wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww"+CT, colorLightBlue+" wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww "+CT]
for ln in ship_one
print(ln)
end for
end function
display_ship_two = function()
ship_two = [" "," |__ ", " |\/ ", " --- ", " / | [ ", " ! | ||| ", " _/| _/|-++' ", " + +--| |--|--|_ |- ", " { /|__| |/\__| |--- |||__/ ", " +---------------___[}-_===_.'____ /\ ", " ____`-' ||___-{]_| _[}- | |_[___\==-- \/ _ ", " __..._____--==/___]_|__|_____________________________[___\==--____,------' .7 ", "| BB-61/ ", " \_________________________________________________________________________| ", colorLightBlue+" Matthew Bacewwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww"+CT, colorLightBlue+"wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww"+CT ]
for ln in ship_two
print(ln)
end for
end function
display_ship_three = function()
// stub
end function
display_long_rule = function()
print(colorGreen+"</b>[.0....1....2.....3....4.....5....6....7.....8....9.]</color>") // adjust this to fit your terminal
end function
/////END GRAPHICS /////////
/////// SANITY CHECK /////
check_sanity = function(sobj) // ensure ships don't overlap
if globals.DEBUG then print("Checking Sanity...")
if globals.DEBUG then print(sobj.frigate)
if globals.DEBUG then print(sobj.cruiser)
if globals.DEBUG then print(sobj.battleship)
bshipX = sobj.battleship.X
bshipY = sobj.battleship.Y
cshipX = sobj.cruiser.X
cshipY = sobj.cruiser.Y
fshipX = sobj.frigate.X
fshipY = sobj.frigate.Y
if globals.DEBUG then print( bshipX )
collision = 0
static_ship = "battleship"
for fx in fshipX
if fx > globals.MAX then collision = "out_of_bounds"
if cshipX.indexOf(fx) >= 0 then
for fy in fshipY
if cshipY.indexOf(fy) >= 0 then
collision = "frigate"
static_ship = "cruiser"
if fy > globals.MAX then collision = "out_of_bounds"
end if
end for
end if
end for
for bx in bshipX
if bx > globals.MAX then collision = "out_of_bounds"
if globals.DEBUG then print("bx:"+bx)
if globals.DEBUG then print("cruiser: index of bx: "+cshipX.indexOf(bx))
if cshipX.indexOf(bx) >= 0 and cshipX.hasIndex(cshipX.indexOf(bx)) then
for by in bshipY
if globals.DEBUG then print("by:"+by)
if cshipY.indexOf(by) >= 0 and cshipY.hasIndex(cshipY.indexOf(by)) then collision = "cruiser"
end for
end if
if fshipX.indexOf(bx) >= 0 then
for by in bshipY
if fshipY.indexOf(by) >= 0 then collision = "frigate"
if by > globals.MAX then collision = "out_of_bounds"
end for
end if
end for
for cx in cshipX
if cx > globals.MAX then collision = "out_of_bounds"
end for
for cy in cshipY
if cy > globals.MAX then collision = "out_of_bounds"
end for
if globals.DEBUG then print("coll:"+collision)
if collision then
if globals.DEBUG then print("Handling collision between "+static_ship+" and "+collision+"...")
// this tactic is known as 'do something, even if it's wrong'
nX = sobj[collision]["X"]
nY = sobj[collision]["Y"]
if nX.len > nY.len then
if nY[0] <= 0 then nY[0] = 3
if nY[0] >= 9 then nY[0] = 5
if nY[0] == 2 or nY[0] == 4 or nY[0] == 6 then nY[0] = nY[0] + 1
rr = range(-1,1)
rr.shuffle
nY[0] = nY[0] + rr.pop
if nY[0] > globals.MAX then collision = "out_of_bounds"
else
if nX[0] <= 0 then nX[0] = 3
if nX[0] >= 9 then nX[0] = 5
if nX[0] == 2 or nX[0] == 4 or nX[0] == 6 then nX[0] = nX[0] + 1
rr = range(-1,1)
rr.shuffle
nX[0] = nX[0] + rr.pop
if nX[0] > globals.MAX then collision = "out_of_bounds"
end if
end if
//////
if globals.DEBUG then print("Handled. Back propagating...")
if globals.DEBUG and not collision then print("Sanity check complete.")
return collision// true for recursion or false if no collisions and sane
end function
//// END SANITY CHECK //////
map = {}
map.grid = []
map.make = function()
map.grid = range(globals.MIN,globals.MAX)
for e in range(globals.MIN,globals.MAX)
map.grid[e] = range(globals.MIN,globals.MAX)
for c in map.grid[e]
if globals.DEBUG then
map.grid[e][c] = e+","+c
else
map.grid[e][c] = colorLightBlue+"www"+CT
end if
end for
end for
end function
map.get_cell = function(x,y)
return map["grid"][x][y]
end function
map.edit_cell = function(xy,beef,actor)
split = xy.split(" ")
if split.len < 2 then
split.push("0")
if split.len < 2 then
split.push("0")
end if
end if
x = split[0].val
y = split[1].val
edit = "www"
if beef > 0 then // hit
if actor == computa.label then
edit = colorOrange+"***"+CT
else
edit = colorRed+"***"+CT
end if
else
if beef == 0 then // miss
if actor == computa.label then
edit = colorLightBlue+"###"+CT
else
edit = colorWhite+"###"+CT
if map["grid"][x][y] == colorLightBlue+"###"+CT then edit = (colorWhite+"#"+CT+colorLightBlue+"#"+CT+colorWhite+"#"+CT)
end if
end if
end if
if globals.DEBUG then print("X:"+x+" Y:"+y+" edit:"+edit)
if map["grid"][x][y] == (colorRed+"***"+CT) then
if beef then
edit = colorRed+"*"+CT+colorOrange+"*"+CT+colorRed+"*"+CT
else
return beef
end if
end if
if beef and map["grid"][x][y] == colorOrange+"***"+CT then edit = colorRed+"*"+CT+colorOrange+"*"+CT+colorRed+"*"+CT
if not beef and map["grid"][x][y] == colorOrange+"***"+CT then edit = (colorWhite+"#"+CT+colorOrange+"#"+CT+colorWhite+"#"+CT)
if not beef and map["grid"][x][y] == (colorWhite+"###"+CT) then edit = (colorWhite+"#"+CT+colorLightBlue+"#"+CT+colorWhite+"#"+CT)
map["grid"][x][y] = edit
return beef
end function
map.display_grid = function()
buf = ""
y = globals.MAX
while y >= globals.MIN
for x in range(globals.MIN,globals.MAX)
buf = buf + "." + map.get_cell(x,y) + "."
end for
buf = buf + colorGreen+"</b>.["+y+"]</color>"+ char(10)
y = y - 1
end while
print(buf)
display_long_rule
end function
map.make
player = {}
player.label = ""
player.opponent = ""
player.BUFFER = {}
player.position = {}
player.display_ship_coordinates = function()
for c in self.position
print(">"+c.value.label+":")
print("[X: "+c.value.X+" Y:"+c.value.Y+"]")
end for
end function
player.fire = function(coords)
aim = coords.split(" ")
print(colorOrange+self.label + " fires at " + aim[0] + ", " + aim[1] + " and... "+CT)
wait(1)
count = 0
for ship_obj in self.opponent.position
if globals.DEBUG then print(ship_obj)
shipX = ship_obj.value.X
shipY = ship_obj.value.Y
count = count + 1
for sx in shipX
if aim[0].val == sx then
for sy in shipY
if aim[1].val == sy then
print(colorRed+"<b>HITS!</b>"+CT+char(10))
summary.accuracy.update(self.label, "hit", coords)
return count
end if
end for
end if
end for
end for
print("<b>MISSES!</b>"+char(10))
summary.accuracy.update(self.label, "miss", coords)
return 0
end function
player.spawn_ship = function(ship)
top_edge = false
bottom_edge = false
left_edge = false
right_edge = false
i = 0
if ship.hasIndex("frigate") then i = ship.frigate
if ship.hasIndex("cruiser") then i = ship.cruiser
if ship.hasIndex("battleship") then i = ship.battleship
if globals.DEBUG then print("["+colorWhite+ship.label+CT+"]")
transmform = function(sob)
if sob.X[0] == globals.MIN then left_edge = true
if sob.X[-1] == globals.MAX then right_edge = true
if sob.Y[0] == globals.MIN then bottom_edge = true
if sob.Y[-1] == globals.MAX then top_edge = true
if sob.X.len > 1 then
top_edge = true
bottom_edge = true
end if
if sob.Y.len > 1 then
left_edge = true
right_edge = true
end if